logo

Phishing Attacks

Category:

Social Engineering

Summary:

How attackers use phishing to steal credentials and MFA sessions for an initial foothold — and how pentesters simulate it to test human and technical defenses.

Phishing tricks a person into helping the attacker — clicking a link, entering credentials on a fake portal, or approving a fraudulent prompt. It’s the most common way real breaches start because it targets the human, not the hardened tech, often supplying the first foothold into Active Directory. Email is only one channel — vishing and smishing target the same trust over phone and text, and a compromised mailbox can escalate into business email compromise. On an engagement, a controlled campaign measures how susceptible staff are and how well mail filtering, MFA, and monitoring catch what gets through.

Common Techniques

  • Credential harvesting — a lookalike login page captures the username and password typed in.
  • Adversary-in-the-Middle (AiTM) — a reverse-proxy kit relays the login and MFA prompt live and steals the session cookie, defeating one-time-code MFA.
  • Spear phishing — targeted messages using real names and internal context to seem legitimate.
  • Malicious attachments — macro docs or LNK/ISO files that deliver code execution when opened.
  • MFA fatigue — repeated push prompts until a tired user taps “Approve.”

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

logo-cta

Testing

Terminal window
# Recon: harvest names/emails for the target
theHarvester -d target.com -b all


# Run a tracked campaign (authorized scope only)
./gophish   # configure sending profile, cloned landing page, and template


# Test MFA resilience with an AiTM proxy
evilginx -p ./phishlets

Report per recipient: delivered, clicked, credentials submitted, and — most importantly — reported to security. Keep those results and any captured credentials or sessions in the pentest report as you go.

Remediation

Deploy phishing-resistant MFA (FIDO2 / passkeys), which AiTM kits can’t relay. Enforce SPF, DKIM, and DMARC, flag external mail, and make reporting a suspicious message one click. Train continuously and apply least-privilege and conditional access so a stolen credential has limited blast radius.