Magic Hound has compromised email credentials in order to steal sensitive data.(Citation: Certfa Charming Kitten January 2021)|
|mitre-attack|enterprise-attack|PRE|T1586.002|Email Accounts|

Magic Hound has compromised personal email accounts through the use of legitimate credentials and gathered additional victim information.(Citation: IBM ITG18 2020)|
|mitre-attack|enterprise-attack|PRE|T1585.002|Email Accounts|

Magic Hound has established email accounts using fake personas for spearphishing operations.(Citation: IBM ITG18 2020)(Citation: Proofpoint TA453 March 2021)|
|mitre-attack|enterprise-attack|PRE|T1589.001|Credentials|

Magic Hound gathered credentials from two victims that they then attempted to validate across 75 different websites.

Magic Hound has also collected credentials from over 900 Fortinet VPN servers in the US, Europe, and Israel.(Citation: IBM ITG18 2020)(Citation: Microsoft Iranian Threat Actor Trends November 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1566.003|Spearphishing via Service|

Magic Hound used various social media channels (such as LinkedIn) as well as messaging services (such as WhatsApp) to spearphish victims.(Citation: SecureWorks Mia Ash July 2017)(Citation: Microsoft Phosphorus Mar 2019)(Citation: ClearSky Kittens Back 3 August 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1571|Non-Standard Port|

Magic Hound malware has communicated with its C2 server over TCP ports 4443 and 10151 using HTTP.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Windows,Office 365,Google Workspace|T1098.002|Additional Email Delegate Permissions|