Why do attackers target users instead of infrastructure in phishing and account compromise campaigns?

Attackers often target users because social engineering is faster and easier than breaking strong technical controls. A successful lure can bypass layers of defence by persuading someone to approve a fake prompt, reuse a weak password, or click a malicious message. Once a user is tricked, the attacker gains a direct path to accounts and data, which is why awareness and reporting matter.

Why phish users instead of attacking the infrastructure directly?

Attackers usually prefer users because people are the easiest point of failure in a well-defended environment. Technical controls may block brute-force access, but a convincing message, fake login page, or prompt can persuade a user to hand over access voluntarily. That makes phishing efficient, scalable, and often cheaper than trying to defeat hardened systems head-on.

That efficiency is why attackers repeatedly invest in lure design, brand impersonation, and timing. A single successful interaction can yield the same outcome as many failed infrastructure attacks: a valid session, a credential, or an approval path that looks legitimate to downstream systems.

How a user compromise turns into account access

Once the user is manipulated, the campaign shifts from persuasion to account abuse. Attackers can reuse stolen passwords, capture MFA prompts, hijack session tokens, or abuse consent and approval flows. In practice, the compromise path matters more than the initial lure, because the attacker is trying to convert one human mistake into durable access.

This is why account compromise campaigns often look simple from the outside but are operationally effective. The attacker does not need to defeat every control in the environment, only the control tied to one identity boundary. When that boundary is crossed, email, SaaS apps, cloud consoles, and business data can all become reachable from a single compromised account.

Campaigns that start with phishing also benefit from the way many organisations distribute trust across users, apps, and third-party services. For example, credential theft and social engineering have been central in the 52 NHI Breaches Report, the MailChimp Breach, and the Poland Military Breach, where a human entry point led to broader account and data exposure.

Why this attack path remains effective even in mature environments

Infrastructure is usually defended with layered controls, monitored services, and hardened configuration. Users, by contrast, operate in a constantly changing context, email, chat, mobile devices, urgent requests, and routine approvals, which creates more opportunities for deception. Attackers exploit that variability because it is harder to standardise than a server baseline.

The other reason the tactic persists is that user compromise often looks like normal activity at first. A legitimate login from the correct geography, a normal-looking API call, or a routine approval can blend into expected behaviour. That makes the initial foothold attractive for attackers, because it can lower detection risk while still opening direct paths to high-value systems.

In more advanced campaigns, adversaries may combine social engineering with automation or session theft to accelerate the takeover. The Anthropic report on the first AI-orchestrated cyber espionage campaign and the CISA cyber threat advisories both reinforce the same operational reality, attackers value the fastest path to usable access, not the most elegant one.

Risk and Threat Considerations

Phishing works because it converts a trust decision into an access decision. The main risk is not the message itself, but the downstream credential, token, or approval abuse that follows when a user is successfully manipulated.

Failure mechanism: A user believes the lure is legitimate, then enters credentials, approves a fake prompt, or grants access that the attacker can immediately reuse for session hijacking, mailbox takeover, or lateral movement.

Impact: The attacker gains a practical foothold that can bypass technical controls, expose sensitive data, and create follow-on access to adjacent systems that trust the compromised account.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, NIST SP 800-63 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	IA-2 — Identification and Authentication (Organizational Users)	User phishing converts identity proof into account access.
	IA-5 — Authenticator Management	Phishing often succeeds by stealing or reusing authenticators.
	AU-6 — Audit Review, Analysis, and Reporting	Account compromise needs timely detection of suspicious logins and approvals.
Recommendation — Require stronger user authentication and reduce credential replay risk. Harden authenticator lifecycle, rotation, and storage. Review authentication and authorization events for phishing indicators.
NIST SP 800-63	Digital Identity Guidelines	Phishing resistance and authenticator strength are central to user account takeover.
Recommendation — Adopt phishing-resistant authenticators and compare assurance levels for access decisions.
CIS Controls v8	CIS-6 — Access Control Management	Account compromise campaigns succeed by turning one user foothold into broader access.
Recommendation — Limit access paths so one compromised account cannot reach everything.
MITRE ATT&CK	T1566 — Phishing	The subject is attacker use of phishing as the initial access method.
	T1078 — Valid Accounts	These campaigns often end with attackers using stolen, valid user credentials.
Recommendation — Map email, message, and credential-theft detections to phishing techniques. Hunt for use of stolen credentials and anomalous authenticated activity.

Practitioner Guidance

What to prioritise: Treat phishing resistance as an access-control problem, not only an awareness problem. Prioritise any control that removes reusable secrets, reduces approval abuse, or limits the value of a single stolen session.

What to verify: Confirm that reporting is fast enough to matter and that suspicious logins, consent grants, and token reuse are visible to the teams that can respond. If the first reliable signal arrives after the attacker has already pivoted, the control set is too late in the chain.

Practitioner takeaway: The best defence is to make user compromise less convertible into durable access, because phishing will keep targeting people whenever people remain the cheapest route around stronger infrastructure.