Phishing remains the cheapest way into an organisation because it attacks the person and the sign-in flow, not the software. Rented kits relay passwords and one-time codes in real time, lures arrive through Teams, SMS and phone calls as well as email, and payloads hide inside HTML, SVG and PDF files that filters treat as harmless. This guide explains the main phishing types, how phishing kits and phishing as a service work, the delivery and evasion tricks defenders must recognise, and the layered controls that limit the damage when a lure gets through. It maps each technique to MITRE ATT&CK, is written for security engineers, SOC analysts and identity teams, and describes techniques only at the level needed to detect and stop them.
Key takeaways
- Assume some phishing will get through. The NCSC states that "Some phishing attacks will always get through, so you should plan for incidents"; design controls that make a click survivable.
- Phishing-resistant authentication removes the main prize. NIST SP 800-63B-4 says codes typed by hand are not phishing-resistant because manual entry "does not bind the authenticator output to the specific session being authenticated"; FIDO2 and certificate-based sign-in do.
- Kits are a service industry. The LabHost platform alone had about 10,000 users paying an average of $249 a month and was linked to at least 40,000 phishing domains before police disrupted it in April 2024.
- Email is only one channel. ATT&CK T1566.003 and T1566.004 cover phishing through social media, messaging apps, Microsoft Teams and voice calls, all of which bypass the email gateway.
- Measure reporting, not just clicks. Fast reports shorten the time before a campaign is purged and credentials are reset; the NCSC recommends measuring reporting as well as clicks.
How phishing maps to MITRE ATT&CK
ATT&CK splits phishing by goal. T1566 Phishing sits under Initial Access and aims to get code running or access granted. T1598 Phishing for Information sits under Reconnaissance, where, in ATT&CK's words, "the objective is gathering data from the victim rather than executing malicious code". Supporting techniques describe the tricks that make a lure work; smuggling and copy-and-paste techniques appear in the delivery table below.
| ATT&CK ID | Name | What it covers | Primary defensive control |
|---|---|---|---|
| T1566.001 | Spearphishing Attachment | Malicious files attached to a targeted message | Block risky file types, detonate attachments, application control |
| T1566.002 | Spearphishing Link | Links to malicious or credential-harvesting sites | Time-of-click URL checks, DNS and web filtering, phishing-resistant MFA |
| T1566.003 | Spearphishing via Service | Lures via social media, personal webmail, WhatsApp, Telegram, Teams, file-sharing notifications and hiring sites | Restrict external chat federation, audit collaboration logs, M1018 account policies |
| T1566.004 | Spearphishing Voice | Phone calls, including callback lures, that lead to remote tools or MFA approval | Caller verification procedures, block unapproved remote management tools |
| T1598.001 to .004 | Phishing for Information (Service, Attachment, Link, Voice) | Collecting credentials or data rather than running code | Phishing-resistant MFA, user reporting, takedown of lookalike sites |
| T1534 | Internal Spearphishing | Lures sent from an already compromised internal account, including through Teams | Detect unusual internal sends after a risky sign-in (DET0054) |
| T1684.001 / T1684.002 | Social Engineering: Impersonation / Email Spoofing | Posing as executives, suppliers or the help desk; forging sender identity | DMARC, impersonation protection, out-of-band verification |
| T1583.001 | Acquire Infrastructure: Domains | Lookalike, homoglyph, IDN homograph and alternative TLD domains | Defensive registration (M1056), new domain monitoring (DET0892) |
ATT&CK lists six mitigations for T1566: M1049, M1047, M1031, M1021, M1054 (SPF, DKIM and DMARC) and M1017. Only M1017 is user training.
Types of phishing
The names describe targeting and channel; knowing the type tells you which control should have stopped it.
| Type | How it works | Control that matters most |
|---|---|---|
| Bulk phishing | Untargeted lures impersonating brands, parcel firms or IT notices | Filtering, browser protection, reporting |
| Spear phishing | Researched lure naming real colleagues, projects or suppliers | Impersonation protection, phishing-resistant MFA |
| Whaling | Spear phishing aimed at executives or their assistants, often for payments or data | Out-of-band payment verification, executive impersonation lists |
| Clone phishing | Copy of a real message with the link or attachment swapped | Detection of thread hijacking from compromised accounts |
| Business email compromise and fake invoices | Spoofed or compromised supplier account asks for changed bank details | Second-channel verification of bank detail changes |
| Gift card scams | A fake manager urgently asks staff to buy gift cards | Clear policy that managers never ask this, first contact warnings |
| Callback phishing (telephone-oriented) | Email with only a phone number for a fake renewal; the call leads to a remote tool install | Block unapproved remote management tools, caller verification |
| Smishing and vishing | SMS or voice lures, often posing as IT support or a bank | Help desk identity verification, phishing-resistant MFA |
| Spearphishing via service | Rapport built on LinkedIn or WhatsApp, or fake IT support over Teams | External access settings, audit logs for collaboration platforms |
Spear phishing vs whaling: whaling is a subset of spear phishing defined by the target's seniority. Executives and their delegates need payment and data-release procedures that a convincing message cannot override. For BEC detail see the Email Identity and BEC Guide, and for voice and video cloning see the Deepfake and AI Impersonation Guide.
AI-driven phishing: generative AI removes the spelling and grammar tells that training once relied on and makes personalisation cheap. It raises the value of controls that do not depend on user judgement: sender authentication, phishing-resistant MFA and application control.
Phishing kits and phishing as a service
A phishing kit is a packaged set of cloned login pages, scripts that collect what victims type, and a back end that forwards results to the operator. Phishing as a service (PhaaS) rents the whole operation: templates for many brands, hosting, domain rotation, anti-analysis filtering and a dashboard. The operator needs no technical skill.
- Scale: according to reporting by The Record on the April 2024 law enforcement action, LabHost had about 10,000 users, offered over 170 fake websites and was linked to at least 40,000 phishing domains. It was estimated to have obtained 480,000 card numbers and more than one million passwords. Europol reported 37 arrests.
- Real-time relay: LabHost's LabRat tool let criminals watch victims live and capture two-factor codes as they were entered. The same relay defeats SMS codes, authenticator app codes and push approvals.
- Adversary-in-the-middle kits: the most capable kits proxy the genuine sign-in page and capture the session cookie issued after MFA, so the attacker never needs the code again. Defending the session is covered in the Token and Session Security Guide, and MFA bypass patterns in the MFA Fatigue and Bypass Guide.
- Anti-analysis: kits commonly filter visitors by IP range, user agent or a CAPTCHA gate, so a URL that scanned clean at delivery can still be malicious at click time.
Phishing kit detection
Defenders rarely see the kit itself, but its infrastructure leaves traces.
- New domain signals: Cloudflare reported that the domain used against its staff in 2022 was registered less than 40 minutes before the campaign started. Its stated lesson was to restrict or sandbox sites on domains registered within the last 24 hours.
- Lookalike domain monitoring: ATT&CK DET0892 recommends watching DNS, WHOIS and passive DNS for domains with a similar structure to your own, including under a different TLD. Certificate transparency logs are a practical feed for the same purpose.
- Takedown: report confirmed sites to the host, registrar and browser safe-browsing services, keeping screenshots and timestamps as evidence.
Delivery and evasion techniques to recognise
As filters improve, lures move to formats and services that filters trust.
| Pattern | Why it evades controls | What stops it |
|---|---|---|
| HTML smuggling (T1027.006) | The payload is assembled in the browser from JavaScript Blobs or Data URLs; the attachment carries benign MIME types such as text/html | Block or sandbox inbound .htm and .html attachments; browser download restrictions; Attack Surface Reduction rules |
| SVG smuggling (T1027.017) | SVG is XML and can include script, yet users and some filters treat it as an image; it can render a fake login form | Block SVG attachments where there is no business need; open them in a sandboxed viewer |
| PDF phishing | A PDF with a single link or QR code contains no executable content for scanners to flag | Extract and check URLs inside documents; time-of-click URL checks |
| Living off trusted sites (SharePoint, DocuSign, file-sharing notices) | The message really comes from a legitimate service, passes SPF, DKIM and DMARC and links to a reputable domain | Inspect the destination behind the notification; restrict guest sharing; phishing-resistant MFA |
| Open redirect phishing | The link starts on a trusted domain that forwards to the phishing site | Follow redirects at time of click; fix open redirects on your own sites |
| Browser-in-the-browser | An HTML window drawn inside the page imitates a single sign-on pop-up, complete with a fake address bar | Password managers and passkeys, which check the real origin |
| Malicious copy and paste (T1204.004) | A fake error or CAPTCHA tells the user to paste a command into the Windows Run dialog or a terminal; no file is downloaded for the gateway to inspect | Application control, PowerShell Constrained Language mode, detection of browser-launched command interpreters |
| Homograph and cousin domains (T1583.001) | Homoglyphs, IDN characters or a different TLD make the domain look right at a glance | Lookalike monitoring, defensive registration, browser IDN display policies |
| Credential prompt impersonation | A page or pop-up copies an operating system or Microsoft 365 prompt | Phishing-resistant MFA |
ATT&CK suggests monitoring the JavaScript APIs Blob, URL.createObjectURL and msSaveOrOpenBlob, and notes that Sysmon Event ID 15 records the HostUrl and ReferrerUrl from the Zone.Identifier stream of a downloaded file, tracing a dropped file to the page that built it. For browser controls see the Enterprise Browser and Browser Security Guide.
Layered defences
The NCSC organises phishing defence into four layers and warns that "Phishing mitigations often place too much emphasis on users being able to spot phishing emails." In its case study of 1,800 Dridex emails, 1,750 were filtered, 14 were clicked, 13 failed to run on patched devices, and the one infection was cleaned within hours.
| NCSC layer | Controls | Concrete settings and examples |
|---|---|---|
| 1. Make it hard for attackers to reach users | Sender authentication, filtering, reduced digital footprint | DMARC at p=reject; in Microsoft Defender for Office 365, "Honor DMARC record policy when the message is detected as spoof", executives in "Users to protect" (up to 350 per policy) and partners in "Domains to protect" (up to 50); in Google Workspace, "Protect against attachment with scripts from untrusted senders" |
| 2. Help users identify and report | Warnings, a one-click report button, verification processes | First contact safety tip; unauthenticated sender indicators (the "?" and "via" tag); a second channel for any request to change bank details or release data |
| 3. Limit the effect of a successful phish | Phishing-resistant MFA, patching, least privilege, macro and script controls, browser protection | FIDO2 or certificate-based sign-in for administrators first; block internet macros; DNS filtering; password managers that refuse to fill on the wrong domain |
| 4. Respond quickly | Logging, playbooks, purge and reset | Purge every copy of a reported message; revoke sessions and reset credentials for anyone who submitted them |
For email architecture, SPF, DKIM, DMARC and post-delivery remediation detail, see the Email Security Guide. For training, simulation design and reporting culture, see the Security Awareness and Human Risk Management Guide.
Choosing controls: decision guidance
- Credential phishing vs malware phishing: credential phishing is beaten mainly by authentication that cannot be relayed. NIST SP 800-63B-4 requires verifiers to "offer at least one phishing-resistant authentication option at AAL2", and only cryptographic authenticators meet AAL3. Malware phishing is beaten mainly by attachment blocking, application control and patching. Let your incident data set the order of investment.
- Phishing-resistant MFA vs number matching: number matching stops blind push approval but not a real-time relay. Cloudflare's 2022 account shows the difference: three employees entered credentials and codes on a cloned page, and the attack still failed because every employee used a FIDO2 key that is bound to the real origin. See the Hardware Security Keys Guide.
- Blocking vs warning: the NCSC notes that blocking can lose legitimate mail while spam folders add user workload. Block file types with no business need (HTML, SVG, ISO, scripts); warn on first contact.
- Small organisations: use the protection built into your email platform with defaults on, enforce DMARC, turn on MFA for email and the identity provider, buy security keys for the few administrators, and give users one easy way to report.
- Large organisations: add impersonation protection tuned to real executive and supplier names, sandboxing, time-of-click URL analysis, newly registered domain blocking, lookalike domain monitoring and automated report-to-purge. Treat Teams, Slack and SMS as in-scope channels.
Where identity fits
Most phishing ends in an identity event: a typed password, a captured session, a granted OAuth consent or a help desk MFA reset.
- OAuth consent phishing: the lure asks for app permissions rather than a password, so MFA never fires. The Cyberhaven Chrome extension breach began with a phishing email that led an employee to grant OAuth consent to a malicious app. Restrict user consent and review app grants; see the SaaS and OAuth App Governance Guide.
- Developer and publishing accounts: a phished maintainer account becomes a supply chain attack. The Solana web3.js npm compromise started with a phished publishing account and shipped a private key stealer. Require phishing-resistant MFA and short-lived publishing tokens for package registries and CI systems.
- Help desk and recovery: voice phishing of the help desk turns a phone call into an MFA reset. See the Account Recovery and Help Desk Security Guide.
How to implement: a phased rollout
- Baseline (weeks 1 to 4): inventory every inbound channel (email, Teams and Slack external access, SMS to corporate phones, help desk lines). Review 90 days of reported messages to see which types reach you, and confirm DMARC status for every owned domain, including parked ones.
- Quick wins (month 2): turn on spoof intelligence and DMARC honouring, the first contact safety tip and a single report button. Put HTML, SVG and script-capable attachments into quarantine first, review a week of hits for false positives, then block; rollback is a return to quarantine.
- Protect the prize (months 2 to 4): move administrators, help desk staff, finance approvers and developers with publishing rights to FIDO2 or certificate-based sign-in. Pilot with a small ring, then enforce through an authentication strength policy. Keep a monitored break-glass account rather than weaker methods for everyone.
- Impersonation and domains (months 3 to 5): populate impersonation lists with real executives and key suppliers, start at the Standard phishing threshold and raise it only after reviewing false positives, and subscribe to newly registered and lookalike domain feeds.
- Endpoint and browser (months 4 to 6): application control for script interpreters, PowerShell Constrained Language mode, internet macro blocking and browser download policies, tested in audit mode first.
- Respond (ongoing): automate the path from report to triage to purge, and from confirmed credential submission to session revocation and reset.
Detection and measurement
What to monitor
- Clicks: time-of-click and proxy logs for visits to newly registered or lookalike domains, joined to the recipient.
- Sign-in anomalies after a click: a successful sign-in from a new ASN, hosting provider or residential proxy shortly after a user visited a suspicious URL is a strong AiTM signal.
- Post-compromise mailbox activity: new inbox rules that hide or forward mail, and bursts of internal sends from one account (T1534).
- Endpoint chains: a browser, mail client or Office process spawning a command interpreter (ATT&CK analytic AN0962 for malicious copy and paste), and files written to temp folders after an HTML attachment opens (AN0872).
- MFA changes: new authenticator registrations shortly after a reported phish.
Metrics that show it is working
- Report rate and time to first report: share of a real or simulated campaign reported, and minutes from delivery to the first report.
- Time to purge: minutes from first report to removal of every copy across mailboxes.
- Phishing-resistant MFA coverage: percentage of privileged, finance and developer accounts that can only sign in with FIDO2 or certificates.
- Credential submissions that led to access: should trend to zero as phishing-resistant coverage grows, even if click rates do not.
- Blocked risky attachments: count of HTML, SVG and script attachments blocked, and the false positive rate after enforcement.
Framework mapping
| Framework | Reference | Relevance to phishing |
|---|---|---|
| NIST CSF 2.0 | PR.AT-01, PR.AA-03, DE.CM-09, RS.MA-01 | Awareness, authentication, monitoring of software and runtime environments, executing the response plan |
| NIST SP 800-53 Rev. 5 | AT-2(1), AT-2(3), SI-3, SI-8, SC-7, IA-2(1), IA-2(2) | Practical exercises, social engineering awareness, malicious code and spam protection, boundary protection, MFA |
| CIS Controls v8.1 | 9.2, 9.3, 9.5, 9.6, 9.7, 14.2, 14.6, 6.3, 6.5 | DNS and URL filtering, DMARC, blocking file types, email anti-malware, social engineering and incident reporting training, MFA |
| ISO/IEC 27001:2022 Annex A | A.6.3, A.8.7, A.8.23, A.5.24 | Awareness and training, protection against malware, web filtering, incident management planning |
| MITRE ATT&CK | T1566, T1598, M1054, M1017, M1021 | Technique and mitigation identifiers for detections and reports |
Common failure patterns
- Codes treated as phishing-proof: the Twilio breach and 0ktapus campaign used SMS lures and cloned sign-in pages that relayed passwords and one-time codes, and spread from Twilio to its customers. OTP and push only raise the cost; they do not stop a relay.
- Trusting a lure because it names a known supplier: in the Dropbox GitHub breach, a fake CircleCI login exposed 130 repositories and developer API keys. Developer tooling brands deserve the same impersonation protection as executives.
- Ignoring voice and personal devices: the Cisco breach combined voice phishing with MFA fatigue. Email controls never saw it.
- Allowing users to consent to apps: the Microsoft verified publisher OAuth phishing campaign showed that a verified badge does not make an app safe to approve.
- Punishing clicks: the NCSC warns that "Employees who are afraid for their jobs will not report mistakes." Cloudflare said the three employees who entered credentials in 2022 "were not reprimanded" and encourages staff to report mistakes.
Practitioner checklist
- Map 90 days of reported phishing to T1566 and T1598 sub-techniques.
- Enforce DMARC on every owned domain and honour sender DMARC policies on inbound mail.
- Move administrators, help desk, finance and package publishers to FIDO2 or certificates, removing weaker methods.
- Block or sandbox HTML, SVG and script-capable attachments after a report-only trial.
- Protect real executive and supplier names from impersonation; turn on the first contact safety tip.
- Block or isolate newly registered domains and monitor lookalike domains, including other TLDs.
- Restrict user consent to OAuth apps and external Teams and Slack access to approved partners.
- Deploy application control and PowerShell Constrained Language mode to blunt malicious copy and paste.
- Give users one report button, never punish reporters, and measure time to report and time to purge.
Standards and references
- MITRE ATT&CK: T1566 Phishing
- MITRE ATT&CK: T1598 Phishing for Information
- MITRE ATT&CK: T1204.004 Malicious Copy and Paste
- NCSC: Phishing attacks: defending your organisation
- NIST: SP 800-63B-4 Authentication and Authenticator Management
- Microsoft Learn: Anti-phishing policies in Microsoft 365
- Europol: International investigation disrupts phishing-as-a-service platform LabHost
- Cloudflare: The mechanics of a sophisticated phishing scam and how we stopped it
Related NHI Mgmt Group resources: Email Security Guide · Security Awareness and Human Risk Management Guide · MFA Fatigue and Bypass Guide · Token and Session Security Guide · Hardware Security Keys Guide