What Is Phishing?

Phishing is the use of fraudulent messages to obtain credentials, deliver malware or induce a harmful action. It remains the most common route into organisations, and the reason is economic: it costs almost nothing per attempt and needs to succeed once.

The important shift is that modern phishing frequently targets the session rather than the password, which means multi-factor authentication alone no longer settles the question.

What the messages are actually after

Credentials, captured through a convincing sign-in page. Session tokens, captured by proxying a real login so the second factor is relayed too. Malware execution, through an attachment or a download.

Or simply an action: approving a payment, changing bank details, installing a tool, granting an application access to a mailbox. That last category carries no malicious file and defeats content scanning entirely.

Adversary-in-the-middle defeats ordinary MFA

Readily available kits proxy the genuine login page. The victim authenticates correctly, including the second factor, and the kit captures the resulting session cookie and replays it.

Codes from applications and text messages provide no protection against this, because the code is relayed in real time. Phishing-resistant methods — hardware keys and passkeys bound to the legitimate domain — do, because the credential will not release to the wrong site.

Technical controls that carry real weight

Authentication of inbound mail, so that messages forging your own domain are rejected. Attachment and link analysis, including rewriting links so they can be checked at the time of the click rather than at delivery.

External sender marking, which is crude and effective. And conditional access requiring a compliant device, which blunts stolen credentials even when they are valid.

Detection, for the messages that get through

Some always will. The useful detections sit after delivery: sign-ins from unfamiliar locations or devices, mailbox rules created to hide replies, mass mail sent from a single account, and application consent grants nobody requested.

Mailbox forwarding rules deserve specific attention. They are a standard post-compromise step, they are quiet, and they persist long after a password reset.

Response, and the step usually missed

Reset the password, revoke active sessions, and check for persistence — mailbox rules, forwarding, registered authentication factors, consented applications. A reset alone leaves every one of those in place.

Then establish what the account could reach. A compromised mailbox is frequently a staging point for internal phishing, which is far more effective because it comes from a real colleague.

The channels moving outside mail scanning

Codes in images, which carry a link no mail gateway can rewrite and which move the click to a personal phone outside every corporate control. Collaboration platform messages, which most organisations do not filter at all. Text messages and calls, which bypass the mail path entirely.

Attackers move to whichever channel is least inspected, and for most organisations that is now everything except email. Extending filtering and reporting to collaboration platforms, and treating a scanned code as an unverified link, closes the more productive of those gaps.

Where to start

Deploy phishing-resistant authentication for administrators and anyone handling payments or sensitive data. It is the one change that makes a captured credential worthless.

See how phishing still works and token theft. GuardsArm delivers security awareness training.