Activity timeline
T1114.002 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-09 with 11 reports, and 46 of the 46 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1114.002 Remote Email Collection is catalogued by MITRE ATT&CK under the Collection tactic in the Enterprise matrix, as a sub-technique of T1114 Email Collection. Threadlinqs maps 46 of 2623 tracked threats (1.8%) to it; by severity that is 11 critical, 31 high, 4 medium.
Threats that use T1114.002 most often also use T1566.002 Spearphishing Link (30 threats), T1528 Steal Application Access Token (27 threats), T1550.001 Application Access Token (24 threats), T1078.004 Cloud Accounts (23 threats), T1087.004 Cloud Account (20 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
17 tracked threat actors appear in the threats that use T1114.002; the most frequent are Storm-2755 (3), APT28 (2), EvilTokens (2), Greatness PhaaS Operators (2), Kali365 (2).
Mitigations
MITRE ATT&CK lists 3 mitigations for T1114.002.
Data sources
Telemetry that can reveal T1114.002, per MITRE ATT&CK.
- Application Log — Application Log Content
- Command — Command Execution
- Logon Session — Logon Session Creation
- Network Traffic — Network Connection Creation
Threat actors using it
Tracked threats
The 30 most recent of 46 tracked threats that use T1114.002.
- EvilTokens (Storm-2992): AI-Chatbot Device-Code Phishing Service Disrupted by Microsoft DCU, Plus AI-Enabled…high
- Microsoft Reissues September 2026 Exchange Server Updates (V2) for CVE-2026-96940 Mailbox Authorization Flawhigh
- CSuite Phishing Operation Steals Microsoft 365 Sessions via Device-Code Phishing and Deploys…high
- OAuth Token Theft via Sideloaded AppX Packages Abusing Microsoft-Signed Web Hosts (WWAHost.exe)high
- Fake Claude Max Giveaway Phishing Campaign Uses Browser-in-the-Browser to Steal Google Credentialsmedium
- Fake Claude Max Giveaway Phishing Campaign Uses Browser-in-the-Browser to Steal Google Credentialsmedium
- TeamFiltration Returns: UNK_CondorFiltration Credential-Spraying Campaign Targets Dormant M365 Service…high
- Microsoft-Led Coalition Takes Down EvilTokens AI-Powered Phishing-as-a-Service Platform (Storm-2992)high
- Passkey-Themed Help Desk Phishing Hijacks Microsoft 365 Cloud Accounts for Data Exfiltrationhigh
- Device Code Phishing Surge: Tycoon2FA, EvilTokens, Kali365, Ghost Hub, and Cyb3r Add MFA-Bypass Capabilityhigh
- CVE-2025-25249: Fortinet Heap-Based Buffer Overflow Exploited to Deploy PivotC2 RAT on FortiGate Devicescritical
- ORB Networks and Nation-State CNI Targeting: Destructive Wiper Attack on Polish Energy Infrastructure via…high
- FBI/IC3 PSA260901: OAuth Consent Phishing Campaign Targeting High-Profile Individuals via Commercial…high
- Advanced Phishing Tradecraft: ClickFix, Browser-in-the-Browser, OAuth Consent, Device Code, and Fake…medium
- CISA Red Team Fully Compromises Two Critical Infrastructure Orgs via ADCS ESC1 and AzureHound Cloud…high
- Hackers Target Zimbra Servers in Active Exploitation Campaign via CVE-2026-73570 SNMP Command Injectioncritical
- Payroll Pirates (Storm-2755) Abuse Microsoft Graph for HR/Finance Staff Recon After AiTM Account Compromisehigh
- U.S. Defense Manufacturer IEH Corporation Breached via Phishing, Potential Export-Controlled Data Exposurehigh
- Microsoft 365 AitM Phishing Campaign Hijacks Sessions via Residential Proxies to Harvest Payroll and Finance…high
- Claude in Chrome "PleaseFix" Prompt-Injection Flaw Enables Gmail/Slack/X/Claude.ai Account Takeoverhigh
- Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal OAuth Tokenshigh
- Greatness PhaaS Platform Spoofs RingCentral in Adversary-in-the-Middle and Device Code Phishing Campaign…high
- OAuth Consent Phishing Abuses Microsoft's Legitimate Login System to Harvest Microsoft 365 Tokenshigh
- Operation RoundPress: TA458 Deploys SpyPress Malware via Half-Click Webmail Zero-Days (CVE-2025-27915…critical
- Kali365 Phishing-as-a-Service Kit Abuses Microsoft Device Code Authentication to Hijack Microsoft 365 Accountshigh
- Apple Hide My Email Address-Disclosure Flaw: Year-Long Unpatched Bounce/NDR Leak Now Subject of Class-Action…medium
- Kali365 Device-Code Phishing-as-a-Service Hijacks Microsoft 365 and Google Workspace OAuth Tokens to Bypass…high
- HOLLOWGRAPH: .NET NativeAOT Malware Abusing Microsoft Graph API and M365 Calendar Events for C2, Linked to…high
- Misconfigured Server Exposes Three Evilginx-Based Microsoft 365 Phishing Operations (codemado, mail-argenta…high
- Browser-in-the-Browser Phishing Campaign Impersonates 34+ Brands' Job Postings to Steal Google Account…high
Detection coverage
Threadlinqs maintains 99 detection rules mapped to T1114.002 (SPL 29, KQL 41, Sigma 29). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1114 Email Collection — 129 tracked threats at the technique level.