Phishing has moved past the clumsy email with a fake login page: current techniques steal sessions that already passed MFA, abuse genuine sign-in flows, and arrive through Teams, search results and the phone. The FBI's IC3 2025 Internet Crime Report recorded 191,561 phishing and spoofing complaints and 24,768 business email compromise complaints in 2025. This list ranks ten techniques by our judgement of frequency and impact on organisations. For each: what it is, how to spot it and the control that matters most, then a mapping to MITRE ATT&CK v20 and OWASP. It is for security operations, email and identity teams, and contains no lure examples.
The Top 10 at a glance
- Adversary-in-the-middle credential and session theft
- Business email compromise and vendor impersonation
- QR code phishing
- OAuth consent phishing
- Device code phishing
- Callback phishing
- Phishing through collaboration tools
- HTML smuggling and attachment lures
- SEO poisoning and malvertising
- AI-generated spear phishing and deepfake voice
| # | Technique | What the attacker gets | First control |
|---|---|---|---|
| 1 | AiTM session theft | Password plus a session cookie that already passed MFA | Phishing-resistant MFA |
| 2 | BEC and vendor impersonation | Redirected payments, often with no link or attachment | Call-back verification of bank detail changes |
| 3 | QR code phishing | Credentials typed on an unmanaged phone | QR extraction in email filtering |
| 4 | OAuth consent phishing | API access that survives a password reset | Restrict user consent |
| 5 | Device code phishing | Access and refresh tokens from a genuine sign-in | Block device code flow |
| 6 | Callback phishing | Remote access tool installed by the victim | Allow only approved remote tools |
| 7 | Collaboration tool phishing | Trust of internal chat, MFA approvals | Limit external chat to trusted tenants |
| 8 | HTML smuggling and attachments | Payload built on the endpoint, past the gateway | Block unneeded attachment types |
| 9 | SEO poisoning and malvertising | Malware or credentials from users seeking a tool | Managed software catalogue, DNS filtering |
| 10 | AI spear phishing and deepfake voice | Convincing personalised pretexts at scale | Out-of-band verification |
1. Adversary-in-the-middle credential and session theft
What it is: the phishing page is a reverse proxy in front of the real sign-in service, so it captures the password and the session cookie issued after MFA. Microsoft reported one AiTM campaign that targeted "more than 10,000 organizations since September 2021"; attackers used stolen cookies in Outlook on the web, sometimes within five minutes, and added inbox rules to hide replies.
How to spot it: one session used from a new IP, ASN or user agent soon after an MFA sign-in, and new inbox rules that move or delete mail.
The control: phishing-resistant authentication (FIDO2 keys, passkeys, certificates), whose origin binding defeats the proxy, and session revocation whenever a user reports a click. See the AiTM Phishing Guide and the Token and Session Security Guide.
2. Business email compromise and vendor impersonation
What it is: a request to pay a new account or change bank details, from a look-alike domain, a display name spoof or a genuinely compromised supplier mailbox. IC3 recorded more than $3.04 billion in BEC losses in 2025, the most of any technique here. Many messages carry no link or attachment, so link and file scanning has nothing to block.
How to spot it: bank detail changes by email, a reply-to that differs from the sender, domains one character from a real supplier, and urgency or secrecy.
The control: verify every bank detail change by calling a number already on file, require dual approval for new payees, enforce DMARC on your own domains and flag first-time senders. See the Email Identity and BEC Guide.
3. QR code phishing
What it is: the malicious URL is encoded in an image, often themed as an MFA reset or document to sign, and scanning moves the victim to a personal phone outside corporate web filtering. Microsoft notes that during the surge "extensive image content analysis was not commonly done for every image in every message". By Microsoft's own figures, Defender for Office 365 blocked 3 million QR phishing attempts a day at the peak.
How to spot it: image-heavy messages with little text from unfamiliar senders, and mobile sign-ins shortly after such a message arrives.
The control: filtering that extracts URLs from images and attachments, plus phishing-resistant MFA, since most QR lures end at an AiTM page. See the Phishing Guide.
4. OAuth consent phishing
What it is: Microsoft's definition: "Consent phishing attacks trick users into granting permissions to malicious cloud applications." ATT&CK places it under T1566.002, with the token theft as T1528. The app holds its own tokens, so a password reset does not remove access. The Microsoft Verified Publisher OAuth phishing case showed a publisher badge obtained by fraud, and the Cyberhaven extension breach began with a single phished consent.
How to spot it: new grants to multi-tenant apps with mail, file or offline access scopes, and API activity from a new service principal soon after consent.
The control: allow user consent only for verified publishers and low-risk permissions, route the rest to admin review, and revoke grants and sessions when removing an app: Microsoft warns "existing access tokens are still valid until their expiration." See the SaaS and OAuth App Governance Guide.
5. Device code phishing
What it is: abuse of the OAuth device authorisation flow. In Microsoft's account of Storm-2372, active since August 2024, the actor "generates a legitimate device code request and tricks the target into entering it into a legitimate sign-in page", using lures that imitate Teams, WhatsApp and Signal meeting invitations, then searches the victim's mail through Microsoft Graph.
How to spot it: sign-ins using the device code protocol by users with no reason to use it, then token use from elsewhere or a new device registration.
The control: Microsoft recommends "blocking device code flow wherever possible" with a Conditional Access authentication flows policy. Phishing-resistant MFA alone does not stop it, because the user completes a genuine sign-in. See the Conditional Access Guide.
6. Callback phishing
What it is: a link-free email, typically about a small subscription charge, asks the reader to phone a number. ATT&CK T1598 notes victims "may also receive phishing messages that direct them to call a phone number." The FBI's May 2025 notification on Silent Ransom Group (Luna Moth) describes callers sending a link to remote access software, then exfiltrating data with WinSCP or Rclone for extortion; from March 2025 the group also phoned staff posing as IT.
How to spot it: renewal notices that ask for a call, new installs of tools such as AnyDesk, Splashtop, Zoho Assist, Syncro or Atera, and WinSCP or Rclone traffic to external IPs.
The control: application control that allows only approved remote access tools, and a published process for how IT verifies itself to staff. See the Vishing and Smishing Guide.
7. Phishing through collaboration tools
What it is: the lure arrives as an external Teams or Slack chat, where users are less wary than in email. In a 2023 campaign attributed to Midnight Blizzard, Microsoft saw compromised tenants renamed with security-themed onmicrosoft.com subdomains used to pose as support and ask targets to enter a code into their Authenticator prompt. The CoPhish research shows consent lures hosted on trusted Microsoft domains.
How to spot it: first-contact requests from external tenants with IT or security display names, and MFA approvals that follow a chat rather than a sign-in.
The control: restrict external access to an allow list of trusted organisations, keep the External label visible, and state that IT never asks for MFA codes in chat. See the Collaboration Tool Security Guide.
8. HTML smuggling and attachment lures
What it is: ATT&CK T1027.006 describes adversaries who "smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML" files; script builds the payload in the browser, so the gateway scans only harmless markup. Archives, disk images and shortcut files serve the same purpose (T1566.001).
How to spot it: HTML, SVG, archive or disk image attachments from external senders, and browsers writing executables or archives immediately after an attachment opens.
The control: block attachment types you do not need, sandbox the rest, and rely on endpoint attack surface reduction and application control for what gets through. See the Email Security Guide.
9. SEO poisoning and malvertising
What it is: the victim searches for software and clicks a result leading to a look-alike site (T1608.006 SEO Poisoning, T1583.008 Malvertising). The FBI warned in December 2022 that paid ads "link to a webpage that looks identical to the impersonated business's official webpage", serving malware or capturing credentials.
How to spot it: installers downloaded from non-vendor domains, and first-seen domains reached from search referrers.
The control: a managed software catalogue so staff do not search for installers, DNS filtering of newly registered domains, and ad blocking on managed browsers, as the FBI suggests. See the DNS Security Guide.
10. AI-generated spear phishing and deepfake voice
What it is: generative AI removes the errors that once gave phishing away, and voice cloning lets a caller sound like an executive. FBI announcement I-120324-PSA (December 2024) warns of AI-written spear phishing, cloned voices and real-time video impersonating executives; IC3 logged 22,364 AI-related complaints in 2025. In the Arup deepfake fraud, a fake CFO on a video call led to HK$200 million in transfers.
How to spot it: polished, personal messages that still ask for something unusual, and executive contact from a new number or account with pressure to skip approval.
The control: verification that never relies on recognising a voice. The FBI advises: "Verify the identity of the person calling you by hanging up the phone", then call a number you found independently. See the Deepfake and AI Impersonation Guide.
Mapping to OWASP
The fit is weak and we say so: no OWASP Top 10:2025 category mentions phishing. The nearest is A07:2025 Authentication Failures, which covers sessions not invalidated (CWE-613) and recommends MFA without distinguishing phishing-resistant methods. MITRE ATT&CK is the better reference: T1566 Phishing and T1598 Phishing for Information, each with Attachment, Link, Service and Voice sub-techniques. All IDs below were checked against ATT&CK v20.
| Technique | MITRE ATT&CK v20 | OWASP Top 10:2025 |
|---|---|---|
| 1. AiTM session theft | T1566.002, T1557 Adversary-in-the-Middle, T1539 Steal Web Session Cookie | A07 (session handling, weak fit) |
| 2. BEC and vendor impersonation | T1566.002; T1598.002/.003 when details are harvested; link-free requests fit no sub-technique well | Not mapped |
| 3. QR code phishing | T1566.001 or .002 (no QR-specific ID) | Not mapped |
| 4. OAuth consent phishing | T1566.002, T1528 Steal Application Access Token | A01 Broken Access Control (over-broad scopes, weak fit) |
| 5. Device code phishing | T1566.002 (named in its description) | A07 (unneeded flow enabled, weak fit) |
| 6. Callback phishing | T1598, T1566.004 Spearphishing Voice | Not mapped |
| 7. Collaboration tool phishing | T1566.003 Spearphishing via Service, T1598.001 | Not mapped |
| 8. HTML smuggling and attachments | T1566.001, T1027.006 HTML Smuggling | Not mapped |
| 9. SEO poisoning and malvertising | T1608.006, T1583.008 | Not mapped |
| 10. AI spear phishing and deepfake voice | T1566.002, T1566.004, T1598.004 | Not mapped |
Where to start
If you can do only three things this quarter: move administrators, finance and executives to phishing-resistant MFA and block device code flow where unneeded (techniques 1, 3, 5, 7); restrict user consent and review existing grants (technique 4); and make out-of-band verification mandatory for payment changes, remote access and MFA resets (techniques 2, 6, 10). Track monthly: share of users on phishing-resistant MFA, user report rate, median time from first report to removal from all mailboxes, OAuth grants with mail or file scopes awaiting review, and device code sign-ins outside the allowed group. See the Security Awareness and Human Risk Management Guide.
Primary sources: MITRE ATT&CK T1566, MITRE ATT&CK T1598, FBI IC3 2025 Internet Crime Report, Microsoft on AiTM phishing, Microsoft on Storm-2372, Microsoft Learn on consent phishing, Microsoft on QR phishing, Microsoft on Teams social engineering, FBI on Silent Ransom Group, FBI I-122122-PSA, FBI I-120324-PSA and OWASP A07:2025.
Related NHI Mgmt Group resources: Phishing Guide · AiTM Phishing Guide · Email Security Guide · Vishing and Smishing Guide · Email Identity and BEC Guide