What Is Multi-Step Phishing? Definition & Examples

Multi-step phishing is a campaign pattern that hides the malicious objective behind one or more trusted intermediate steps. The first message often looks benign, then redirects the target through a legitimate service before reaching the credential-harvesting page. This structure reduces visibility for email defenses and increases the chance of user trust.

How Multi-Step Phishing Works

Multi-step phishing is built to look ordinary at the first touchpoint. The attacker uses a benign-looking email, message, or workflow step to lower suspicion, then moves the target through a trusted intermediary, such as a cloud document, shared inbox, or branded service, before the credential harvest occurs. That extra hop matters because it breaks the simple “bad link in suspicious email” pattern many users and filters are tuned to catch.

The tactic is effective because the trusted intermediary carries inherited credibility. A message that appears to come from a familiar collaboration tool, file-sharing service, or internal-looking process often survives a first glance, even when the end destination is malicious. In practice, the campaign is less about one malicious message than about sequencing trust across multiple steps.

That sequencing also complicates investigation. Security teams may see only the intermediate service, while the true objective sits one redirect later. If the chain includes credential theft or token capture, the visible indicator set can look fragmented unless analysts reconstruct the full path.

Why Attackers Use a Multi-Step Chain

The main advantage is friction reduction. Each stage can be made to appear routine, which increases the chance of user interaction and reduces the chance that reputation-based email controls block the campaign early. Attackers also gain flexibility, since they can swap the final payload, rotate intermediary services, or change the lure without redesigning the whole chain.

Multi-step phish also benefits from trust laundering. By the time the target reaches the harvest page, the original suspicious context has faded. The user is responding to a sequence of apparently legitimate prompts rather than a single obvious fraud attempt, which is especially effective when the intermediate step resembles common business activity such as document review, account verification, or shared-content access.

For defenders, this means a URL reputation check alone is often insufficient. The risk is not just the destination, but the path taken to get there. A benign first hop can still be part of a credential theft or session capture campaign, even if the final page is hosted elsewhere.

Security Implications for Detection and Response

Multi-step phishing increases the gap between what users see and what defenders can observe. Email security tools may only inspect the initial lure, while browser, web proxy, and identity telemetry reveal later stages. That creates a detection challenge because the suspicious behavior may be distributed across several services rather than concentrated in one obvious event.

One useful reference point is NIST SP 800-63 Digital Identity Guidelines, which supports phishing-resistant authentication as the right direction when credential theft is part of the threat model. In a campaign like this, a password prompt alone is not a reliable trust signal, and stronger authentication reduces the value of harvested credentials.

Response also needs chain reconstruction. Analysts should preserve the initial message, the intermediary URL, and the final destination as a single narrative, because each step may belong to a different service or log source. That matters for containment, user notification, and scoping whether a harvest attempt succeeded or merely collected typed credentials.

How It Differs From Simple Phishing

Simple phishing usually tries to land the victim directly on the malicious page. Multi-step phishing inserts one or more intermediaries to obscure intent, raise perceived legitimacy, and stretch the campaign across multiple systems. That makes it harder for defenders to spot the attack from one artifact alone.

The distinction is operational, not cosmetic. If the intermediate step is removed, the campaign may become far easier to flag, because the malicious objective is no longer disguised behind a trusted service. For this reason, multi-step phishing should be treated as a trust-chain problem, not just an email filtering problem.

For teams studying real-world patterns, MailChimp Breach illustrates how social engineering can lead to credential compromise and downstream exposure, while CoPhish OAuth Token Theft via Copilot Studio shows how phishing-style chains can extend into token theft and identity abuse.

Risk and Threat Considerations

Multi-step phishing raises the chance of successful credential theft because it uses trusted-looking transitions to defeat user suspicion and delay detection. The real risk is not just that a message is clicked, but that the intermediate step makes the final harvest page seem routine enough to collect passwords, tokens, or session data.

Failure mechanism: The attacker leverages a legitimate service or redirect chain to inherit trust, hide the true destination, and separate the lure from the credential harvest, which weakens both user judgment and first-pass security filtering.

Impact: Successful execution can lead to account takeover, token theft, broader mailbox or SaaS compromise, and a wider incident scope because the visible entry point does not match the final point of compromise.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-63 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-63	Digital Identity Guidelines	Supports phishing-resistant authentication when phishing targets credentials or sessions.
Recommendation — Adopt phishing-resistant authenticators to reduce the value of harvested credentials.
MITRE ATT&CK	T1566 — Phishing	Covers phishing-driven initial access and the lure techniques used in multi-step campaigns.
	T1556 — Modify Authentication Process	Relevant when the campaign aims to intercept or subvert login or token flows.
Recommendation — Map observed lure steps to phishing techniques and hunt for delivery chains. Inspect authentication flows for manipulation that redirects users into harvest paths.
NIST SP 800-53 Rev 5	AU-6 — Audit Review, Analysis, and Reporting	Supports correlating email, web, and identity logs across a multi-step attack path.
	IA-2 — Identification and Authentication (Organizational Users)	Applies where phishing targets user authentication to gain account access.
Recommendation — Correlate multi-source logs to reconstruct the full phishing chain. Strengthen user authentication to limit account takeover after phishing.

Practitioner Guidance

What to watch for: Treat any phishing report that involves a benign first step, especially a redirected login, shared document, or branded collaboration flow, as a chain investigation rather than a single-URL event. The useful question is often where the user was sent after the first trusted hop, not just what the initial lure looked like.

Governance implication: Email, browser, identity, and SaaS logging all need to be usable together, because no single control usually sees the entire path. Teams should ensure that incident handling can preserve intermediate URLs and follow-on authentication events as one case, not as disconnected alerts.

Practitioner takeaway: If the attack depends on trust transfer between steps, then detection must follow the same path transfer, otherwise the most important part of the campaign stays invisible.

Multi-Step Phishing