Phishing (Credential Harvesting & Scams)
What is Phishing?
Phishing remains one of the most widespread and damaging cyber attack vectors worldwide. Attackers send fraudulent communications disguised as trusted organizations—such as Microsoft 365, Google Workspace, postal couriers (DHL, FedEx, Czech Post), tax authorities, or popular streaming platforms.
The primary objective is almost always to direct the victim to a pixel-perfect fake login page where entered credentials (and often active 2FA session tokens via Adversary-in-the-Middle proxies) are harvested by the threat actor.
The Phishing Attack Sequence
- Bait Crafting: Attackers replicate corporate branding, logos, and email templates (e.g. "Password expiring in 24 hours" or "Package delivery suspended due to unpaid customs fee").
- Domain Spoofing & Lookalikes: Scammers register lookalike domains (
rnicrosoft.com,micros0ft-login.com,post-package-tracking.net) or abuse compromised legitimate domains. - Mass or Targeted Dispatch: Automated mailers deliver thousands of messages, bypassing basic spam filters with homoglyphs, encoded links, or QR codes (Quishing).
- Credential Harvesting: The victim lands on a fake authentication portal. As soon as user inputs username, password, or SMS OTP, it is relayed directly to the attacker.
- Account Takeover (ATO): Attackers log into the victim's genuine account, establish mailbox forwarding rules, and pivot deeper into the corporate network.
Real-World Simulation
"Subject: URGENT Security Alert: Your Microsoft 365 Session Has Expired
Dear Employee,
Our security monitoring detected suspicious sign-in attempts against your account from an unrecognized IP in Warsaw. Your access will be locked in 30 minutes unless you verify your identity.
Click here to confirm your credentials and update password
Failure to comply will result in an immediate IT security suspension."
Pay attention to the urgency of the email (URGENT etc.). Hackers use it to put time
pressure on you, so you will not spot the suspicious details and mistakes in the email.
Defense Checklist
- Inspect the actual sender address, not just display name: Check the domain after the
@symbol carefully. Look
--- Unknown node: hardBreak ---
for misspellings, substitute characters (rnvsm- @microsoft.com vs @rnicrosoft.com, etc.), or strange top-level domains. - Hover before clicking: Hover your cursor over hyperlinks to inspect the destination URL before clicking. If on mobile, long-press to view preview.
- Never authenticate via links sent in unsolicited emails: Navigate directly to known services by typing their address into your browser or using verified bookmarks.
- Use FIDO2 / Passkey Hardware Authentication: Phishing-resistant multi-factor authentication (like YubiKeys or Windows Hello / Passkeys) prevents credential harvesting even if you land on a spoofed portal.
- Beware of QR code emails (Quishing): Never scan QR codes embedded in security notifications or password reset emails.
Immediate Actions If Phished
- Immediately change passwords on legitimate portals: Do not use the link from the email. Open a new browser window, log into the official service, and change your credentials.
- Revoke all active sessions and app passwords: In Microsoft 365 or Google, trigger a "Sign out of all devices" command.
- Inspect email inbox forwarding rules: Attackers routinely create hidden rules to silently forward incoming emails or delete notifications from security teams.
- Notify IT Security (SOC): Prompt reporting allows defenders to blacklist the phishing domain across the entire enterprise gateway and reset impacted tokens.
Resources & References
- Komerční banka – Bezpečnost a typy útoků – Guide on email scams, fake e-banking portals, and smishing defense.
- CISA – Recognizing and Reporting Phishing – Cybersecurity and Infrastructure Security Agency best practices.
- NÚKIB – Doporučení k ochraně před phishingem – National Cyber and Information Security Agency advisory.
- MITRE ATT&CK – Technique T1566: Phishing – Comprehensive adversary tactics and techniques index.