MailSniper
MITRE ATT&CK: S0413 View on attack.mitre.org
Aliases: MailSniper
- First seen
- 2017-01-01 00:00:00
- Malware type
- credential-stealer
- Operating systems
- windows, office-suite
- Profile updated
- 2026-07-07 15:32:49
Targeted industries: professional-services technology-and-telecommunications government-and-public-sector
Context
MailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms (passwords, insider intel, network architecture information, etc.). It can be used by a non-administrative user to search their own email, or by an Exchange administrator to search the mailboxes of every user in a domain.
Malware & tools used
- Remote Email Collection (attack-pattern)
- Password Spraying (attack-pattern)
- Email Account (attack-pattern)
Used by threat actors
- Leafminer (threat-actor)
Reports & references
- MITRE ATT&CK — S0413 (report)
- github.com — Mailsniper (report)