Phishing kit anatomy
Modern phishing-as-a-service operations sell turnkey kits with three components:
- Lure delivery: subscription-grade SMTP, look-alike domains, redirector chains through compromised WordPress sites to avoid URL blocklists.
- Reverse proxy (Evilginx, Modlishka, Muraena): the phishing page proxies every request to the real target site in real time. The victim types credentials and the OTP into what looks like the real Microsoft / Google login. The proxy captures the resulting session cookie and the attacker logs in immediately as the victim. This defeats classical OTP and push MFA.
- Exfiltration: captured creds and cookies posted to a Telegram bot or attacker-controlled API in real time.
The Evilginx-class attack is why "phishing-resistant" became a meaningful distinction. Origin-bound credentials (WebAuthn) survive; everything else does not.
BEC operational patterns
Business Email Compromise dwarfs every other social engineering category by dollar loss. Three common shapes:
- CEO fraud: spoofed or look-alike CEO email to a finance employee, urgent wire request. Often after the attacker has compromised the CEO's email and read enough to mimic style.
- Vendor invoice fraud: attacker compromises a vendor's mailbox, watches for an outgoing invoice, sends a follow-up changing the bank details. The victim never doubts the source because it really is the vendor.
- Payroll diversion: attacker emails HR/payroll as the employee, asking to change direct deposit. Catches the next paycheque, then disappears.
Defense pattern: every change-of-banking request goes through a verified callback to a known phone number, never to one in the email. Train finance to expect this as the policy, not an exception.
OSINT and pretext crafting
Targeted phishing starts with OSINT. LinkedIn for org chart, public filings for board members, conference talks for technical detail, GitHub for engineer email patterns, Have I Been Pwned for which password leaks the target appears in.
Automated pipelines (Maltego, SpiderFoot) make this a few-minute job. Defenders make it harder by minimizing public exposure (private LinkedIn settings, no internal hierarchies in talks, no real names in commit emails).
Vishing and deepfake voice
Voice phishing has industrialised. IVR systems mimic banks. Voice cloning needs as little as a 30-second sample. 2024 saw multi-million dollar transfers triggered by a "CFO" video call where every participant except the victim was synthetic.
The deployable defense is procedural, not technological: high-value financial actions require a callback to a number on the official corporate directory or a multi-party approval chain that humans cannot bypass alone.
Phishing-resistant MFA + DMARC enforcement
The two interventions that move the needle:
- FIDO / WebAuthn everywhere: phishing pages cannot proxy WebAuthn because the credential is origin-bound. A user who types nothing and only taps a security key never gives the attacker anything reusable.
- DMARC at
p=reject: enforces SPF/DKIM alignment on your own domain. Stops spoofed-as-you mail from reaching anywhere that respects DMARC. Pair with BIMI so legitimate mail shows your logo, making spoofs more obvious in inboxes that support it.
Awareness training catches some users some of the time. The technical controls catch everyone all the time within their scope.
Reporting culture
The most underrated control: a one-click "report phish" button in the email client, plus a culture where the first report wins applause and quick acknowledgment. Most users will report if it is easy and they see something happen with their reports.