Activity timeline
T1114.003 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 6 reports, and 15 of the 15 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1114.003 Email Forwarding Rule is catalogued by MITRE ATT&CK under the Collection tactic in the Enterprise matrix, as a sub-technique of T1114 Email Collection. Threadlinqs maps 15 of 2623 tracked threats (0.6%) to it; by severity that is 3 critical, 12 high.
Threats that use T1114.003 most often also use T1078.004 Cloud Accounts (11 threats), T1566.002 Spearphishing Link (11 threats), T1528 Steal Application Access Token (10 threats), T1087.004 Cloud Account (9 threats), T1204.001 Malicious Link (9 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
11 tracked threat actors appear in the threats that use T1114.003; the most frequent are EvilTokens (2), Greatness PhaaS Operators (1), Kali365 (1), Kali365 PhaaS operators (1), Scattered Spider (1).
Mitigations
MITRE ATT&CK lists 4 mitigations for T1114.003.
Data sources
Telemetry that can reveal T1114.003, per MITRE ATT&CK.
- Application Log — Application Log Content
- Cloud Service — Cloud Service Metadata
- Command — Command Execution
Threat actors using it
Tracked threats
15 tracked threats use T1114.003.
- Fortinet FortiMail critical path traversal flaw CVE-2026-104286 (FG-IR-26-175) exploited in zero-day attackscritical
- AI-Enabled Social Engineering and Synthetic Media (Deepfakes) Undermining Identity Verificationhigh
- Microsoft-Led Coalition Takes Down EvilTokens AI-Powered Phishing-as-a-Service Platform (Storm-2992)high
- Mass Phishing and Scam Campaign Abuses 450+ Compromised Google Workspace Accounts in the Education Sectorhigh
- Unit 42: Identity Compromise Is the Primary Attack Vector in Nearly 90% of Incidentshigh
- Greatness PhaaS Platform Spoofs RingCentral in Adversary-in-the-Middle and Device Code Phishing Campaign…high
- Operation RoundPress: TA458 Deploys SpyPress Malware via Half-Click Webmail Zero-Days (CVE-2025-27915…critical
- Kali365 Device-Code Phishing-as-a-Service Hijacks Microsoft 365 and Google Workspace OAuth Tokens to Bypass…high
- EvilTokens Phishing-as-a-Service Kit Abuses Microsoft Device Code Authentication with AES-GCM "Ghost Code"…high
- Zimbra Collaboration Suite Critical Stored XSS in Classic Web Client (Patched in ZCS 10.1.19)critical
- ARToken Phishing Panel Abuses Microsoft OAuth Device Code Flow to Hijack Microsoft 365 Accounts (EvilTokens…high
- ARToken: Business Email Compromise-as-a-Service Platform Targeting Microsoft 365 (Cisco Talos / EvilTokens…high
- UNC6508 (PRC-Nexus) Trojanizes Unpatched REDCap Research Servers with INFINITERED Malware to Spy on North…high
- EvilTokens Phishing-as-a-Service: Microsoft OAuth 2.0 Device Authorization Grant (Device Code) Phishing…high
- Kali365 PhaaS — Telegram-Distributed Microsoft 365 Device-Code Phishing with OAuth Token Theft & MFA Bypass…high
Detection coverage
Threadlinqs maintains 38 detection rules mapped to T1114.003 (SPL 14, KQL 13, Sigma 11). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1114 Email Collection — 129 tracked threats at the technique level.