Skip to content

PH!SH Framework

Framework Getting started MITRE ATT&CK About Contribute Versions

/

Framework / Techniques

Technique Spoofing

Spoofed HOPS

Email headers are manipulated to make messages appear as if they originated from legitimate sources, evading detection.

Mapped to

MITRE ATT&CK®

T1684.002Email Spoofing

Spoofing

TE0001Spoofed Sender TE0002Spoofed HOPS TE0003Right-To-Left Override TE0027Spoofed Hyperlink

PH!SH Framework

An open classification of phishing and social engineering, maintained by Hoxhunt threat research.

PH!SH v1.0

Site

Framework Getting started MITRE ATT&CK About

Community

Contribute Version history License and citation

Related work

© 2026 Hoxhunt. PH!SH framework content is licensed under CC BY 4.0. License and citation

© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

PH!SH is not affiliated with or endorsed by The MITRE Corporation.