Phishing techniques are methods used to trick people into revealing secrets, approving actions, or installing malware. They often use fake emails, messages, websites, or calls that imitate trusted sources. In security operations, these tactics target human IAM, NHI credentials, and access workflows to gain unauthorized entry.
What Phishing Techniques Are Used For
Phishing techniques work by exploiting trust, urgency, and routine behaviour. Attackers imitate familiar senders or services so targets will disclose secrets, approve transactions, or run code without pausing to verify the request.
The practical power of phishing is not the message alone, but the path it opens. A convincing lure can move a victim from a trusted channel into an attacker-controlled workflow, where stolen credentials, token approvals, or malware execution become the real objective.
Common Phishing Patterns and Delivery Methods
Phishing is an umbrella term, and the delivery method often shapes the control failure. Email remains common, but modern campaigns also use SMS, collaboration platforms, QR codes, fake login portals, callback lures, and consent prompts that look legitimate at first glance.
Some techniques are designed to bypass simple user skepticism. Lookalike domains, cloned pages, browser-in-the-browser tricks, HTML smuggling, and malicious attachments all try to make the user’s normal trust cues work against them. Phishing Guide covers these patterns in more detail, including kit-based attacks and lookalike domain detection.
What Phishing Steals or Triggers
The highest-value targets are secrets and authority. Phishing often aims to capture passwords, session cookies, MFA codes, OAuth consent, API keys, recovery tokens, or approval actions that let an attacker bypass direct authentication altogether.
That is why phishing is so often an access problem rather than a simple fraud problem. In practice, a single successful lure can expose both human IAM and non-human credentials, especially when staff approve access on behalf of services, automation, or developer tooling. Incidents such as CoPhish OAuth phishing via Copilot Studio show how consent workflows can be abused to steal tokens, while Dropbox GitHub breach 2022 shows the downstream impact when phished access reaches source code and developer secrets.
How Defenders Reduce Phishing Success
Defence works best when it reduces both the chance of deception and the value of stolen access. Strong authentication helps, but phishing-resistant sign-in methods, tighter approval workflows, and better session binding matter because many lures are designed to steal what a password alone cannot protect.
Operationally, organisations need layered controls around email, identity, endpoints, and user behaviour. Monitoring for domain impersonation, unusual consent grants, impossible travel, token replay, and suspicious inbox rules can reveal campaigns before they become full compromise. MITRE ATT&CK Enterprise Matrix is useful for mapping phishing to credential access and follow-on techniques, and NIST SP 800-63 Digital Identity Guidelines provides the authentication context for phishing-resistant enrolment and verification.
Risk and Threat Considerations
Phishing is dangerous because it targets the weakest and most reusable trust boundary in many environments, the person making an approval or entering a secret. Once a user is tricked, the attacker may inherit the same access path the organisation intended only for a trusted actor, including access to shared tools, cloud consoles, and delegated workflows.
Failure mechanism: The lure bypasses normal suspicion, then captures credentials, session material, or an approval that grants real authority. The attacker can reuse that access to move from initial deception into persistence, token theft, data access, or further impersonation.
Impact: A successful phish can expose accounts, secrets, repositories, finance approvals, or automation access, and may also create post-compromise cleanup work such as token revocation, credential rotation, and mailbox or session review.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-63 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1566 — Phishing | Defines phishing as an adversary access technique used to obtain credentials or execution |
| Recommendation — Map phishing lures to T1566 and hunt for credential theft, token abuse, and follow-on access activity. | ||
| NIST SP 800-63 | 5.2 — Phishing-Resistance | Phishing techniques directly challenge authentication assurance and verifier binding |
| Recommendation — Use phishing-resistant authenticators and verification flows that resist replay and impersonation. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Phishing commonly targets credential capture, reuse, rotation, and revocation |
| Recommendation — Harden authenticator lifecycle controls and revoke exposed credentials and tokens quickly. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Phishing often steals or reveals non-human secrets used for access and automation |
| NHI-07 — Long-Lived Secrets | Phishing becomes more damaging when stolen secrets remain valid for long periods | |
| Recommendation — Reduce secret exposure and rotate compromised machine or application secrets after phishing. Shorten secret lifetime and eliminate durable credentials that attackers can reuse after a phish. | ||
Practitioner Guidance
Why practitioners should care: Phishing is rarely just a user-awareness issue. It is an identity and access failure mode that tests whether your organisation can distinguish legitimate intent from fraudulent pressure at the point of action.
What to watch for: Treat unusual consent prompts, new device sign-ins, inbox-rule creation, lookalike domains, and unexpected reauthentication as signals worth immediate review. When a phish succeeds, assume the attacker may already hold a reusable credential or session and investigate the surrounding access path, not just the email itself.
Practitioner takeaway: The most effective phishing defence combines user verification, phishing-resistant authentication, and fast post-compromise containment, because prevention alone will never stop every lure.
Related resources from NHI Mgmt Group
- What breaks when phishing simulations stay static while attacker techniques keep changing?
- What breaks when MFA bypass techniques and adversary in the middle phishing are not accounted for in access controls?
- How should security teams test phishing controls against modern evasion techniques?
- How should organisations adapt phishing defenses when attackers are using session theft and MFA bypass techniques?