Phishing attack techniques are the methods attackers use to trick people or systems into revealing credentials, secrets, or approving malicious access. They often combine deceptive messages, fake login pages, impersonation, and urgency. In identity security, they target human IAM, NHI secrets, and authentication workflows to bypass controls and gain unauthorized access.
What phishing attack techniques do
Phishing techniques are the delivery methods and social-engineering patterns attackers use to trick a target into giving up access, approving a request, or moving to a fake trust boundary. The practical security problem is not just deception, but the bypass of normal verification paths.
Modern phishing is broader than a single fake email. It now includes callback lures, QR abuse, OAuth consent fraud, device-code abuse, lookalike domains, and impersonation across chat, phone, and collaboration tools, which is why defenders need to think in terms of the technique, not just the message format. Top 10 Phishing Techniques
Why phishing works
Phishing succeeds when it exploits trust, urgency, routine, or fatigue. The target is often pushed to act before they verify the sender, domain, prompt, or approval request, so the attacker can obtain credentials, tokens, session access, or a malicious authorization.
The strongest campaigns often blend several tricks at once: a believable pretext, a convincing login flow, and a time pressure cue that reduces scrutiny. In identity-heavy environments, the real objective is frequently not the password itself, but the access that follows from captured credentials, consent grants, or session theft.
Because these techniques are reusable across email, SMS, voice, collaboration tools, and even AI-assisted workflows, the defensive lesson is to treat phishing as an access-path problem, not only a messaging problem.
Common phishing technique families
Phishing technique families differ in how they reach the target and what they steal. Link-based lures drive victims to counterfeit login pages. Attachment-based lures use files, scripts, or smuggling to deliver payloads or redirect the user. Voice and callback phishing use human conversation to bypass written verification. OAuth consent phishing and device-code phishing target modern authentication flows instead of passwords alone.
Other variants abuse trusted infrastructure or brand familiarity, such as lookalike domains, compromised senders, or legitimate services used as delivery channels. Some attacks focus on session capture or token theft after login, which means multifactor authentication may not be enough if the attacker can hijack the session itself.
At the high end, phishing is often a staging technique for broader compromise, including cloud access, source-code theft, business email compromise, and secret exposure. MITRE ATT&CK Enterprise Matrix helps map those technique chains to downstream attacker behaviour.
How organisations reduce phishing exposure
Exposure reduction starts with knowing which accounts, workflows, and approval paths are attractive to attackers, then hardening the highest-value ones first. Phishing-resistant authentication, stricter domain and sender controls, safer consent handling, and tighter verification for risky requests all reduce the chance that a single lure becomes a breach.
Detection also matters. Security teams should look for impossible travel, unusual login prompts, suspicious OAuth grants, abnormal forwarding rules, newly created inbox rules, and token or session abuse after a lure lands. Where phishing is being used as a delivery method for adversary access, the response needs to cover both the lure and the resulting compromise path. CISA cyber threat advisories are a useful source for current abuse patterns and defensive focus areas.
For technique-level defence planning, a threat-informed approach is more effective than generic awareness alone, because it ties controls, detections, and validation to the specific phishing methods attackers are using. Threat-Informed Defence Guide is useful when you want to connect phishing techniques to ATT&CK-style monitoring and validation.
What happens after a phishing success
Once phishing succeeds, the impact is often wider than the initial account takeover. Attackers may reuse captured credentials, pivot through trusted sessions, harvest additional secrets, impersonate the victim, or use the compromised account to phish others. In cloud and developer environments, a single successful lure can expose API keys, repository access, or privileged support tooling.
The post-compromise review should focus on what the attacker could reach, what was actually used, and whether any sessions, tokens, keys, or delegated approvals remain valid. If the attack involved identity-bearing material or consent-based access, rotation and revocation should be treated as part of containment, not as an optional follow-up.
For organisations that want a deeper identity-and-secret lens on real-world breach patterns, The State of NHI & AI Agent Breach Report 2026 shows how stolen tokens, leaked keys, and compromised service accounts are often the real prize after the lure succeeds.
Risk and Threat Considerations
Phishing techniques are dangerous because they are scalable, adaptable, and effective against both people and automated trust workflows. A successful lure can turn a single mistake into credential theft, session hijack, unauthorized consent, or downstream secret exposure across many systems.
Failure mechanism: The attacker exploits trust cues and time pressure to bypass verification, then captures credentials, tokens, approvals, or other access material that can be reused immediately or later.
Impact: The result can be account takeover, unauthorized access, lateral movement, data theft, fraudulent approval, or compromise of systems that depend on the victim’s identity or delegated access.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1566 — Phishing | Defines phishing as an adversary technique family used to gain initial access. |
| Recommendation — Map observed phishing activity to T1566 and build detections around the lure, delivery, and credential theft stages. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Phishing often abuses passwords, tokens, and authenticator lifecycle weaknesses. |
| IA-2 — Identification and Authentication (Organizational Users) | Phishing targets user authentication flows and organizational account takeover. | |
| IA-9 — Service Identification and Authentication | Phishing can steal or abuse non-human credentials and service access paths. | |
| Recommendation — Enforce IA-5 to manage credentials and reduce reuse, theft, and weak authenticator handling. Apply IA-2 to strengthen user authentication and reduce takeover risk from deceptive logins. Use IA-9 to authenticate services and limit abuse of machine and workload access. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | Phishing frequently captures API or application credentials that are then reused illegitimately. |
| Recommendation — Harden authentication paths so stolen credentials cannot be replayed into APIs. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Phishing aims to obtain or abuse access, making account and entitlement control central. |
| Recommendation — Use CIS-6 to tighten access, remove unnecessary pathways, and limit abuse after phishing. | ||
Practitioner Guidance
Why practitioners should care: Phishing is best handled as a control design problem, not just an awareness problem. If your highest-risk workflows still depend on a user spotting a fake message, the environment is too easy to abuse.
What to watch for: Repeated consent prompts, unusual login challenges, new forwarding rules, unexpected file or link delivery patterns, and help-desk or collaboration-tool impersonation are all signals that a phishing method may already be in play.
Practitioner takeaway: The most resilient programmes pair phishing-resistant authentication with technique-specific detection, because the attacker’s goal is usually to turn one deceptive interaction into durable access.