Skip to content
Pwnversity

Phishing campaigns

Phishing is the number-one intrusion vector. This card covers how a campaign is designed and run in an authorized engagement (from pretext to infrastructure to metrics) and how it’s stopped on the defensive side.

Types

Section titled “Types”
Mass phishing     generic email to many people (low rate, high volume)
Spear phishing    targeted, personalized with OSINT (see se-pretexting) -> high effectiveness
Whaling           targeted at senior executives (CEO/CFO)
BEC               Business Email Compromise: CEO/vendor fraud to redirect payments
Clone phishing    copy of a legitimate email with a swapped link/attachment

Campaign goals (what’s measured)

Section titled “Campaign goals (what’s measured)”
- credential theft (cloned login page on controlled infrastructure)
- payload execution (attachment/link) to gain access (in authorized engagement)
- plain awareness metric: how many click / report?

Anatomy of the pretext and lure

Section titled “Anatomy of the pretext and lure”
Sender     look-alike domain (typosquatting), trusted display name, or compromised domain
Subject    urgency/authority ("Action required: your password expires today")
Body       imitated brand, link that looks legit, clear call to action
Landing    cloned login page on YOUR infrastructure (only with authorization)
Timing     Tue-Thu during work hours; avoid language/formatting errors

Infrastructure (authorized engagement)

Section titled “Infrastructure (authorized engagement)”
- credible-looking domain + categorization + "aged" registration
- authenticated mail to reach the inbox: SPF/DKIM/DMARC of the attacker domain
- TLS on the landing; redirect after capture; clean handling of captured credentials
- campaign framework (GoPhish, see se-tools) for sending, tracking, and metrics
# NOTE: every captured credential is personal data -> handle per GDPR and destroy after the report

Filter-evasion techniques (conceptual)

Section titled “Filter-evasion techniques (conceptual)”
- links in legitimate redirectors/services, QR in an image ("quishing")
- HTML attachments that build the page client-side; light body obfuscation
- avoid trigger words and raw URLs; personalization to not look like mass mail

Metrics and reporting

Section titled “Metrics and reporting”
Open / click / credential-submit / report rate
Time to first report (the sooner, the better the defensive culture)
-> the report's goal is to TRAIN and improve controls, not to name people

Defense (blue team)

Section titled “Defense (blue team)”
  • Phishing-resistant MFA (FIDO2/passkeys): even if the password is stolen, they don’t get in.
  • DMARC at p=reject + SPF/DKIM; mail filtering, attachment sandboxing, URL rewriting.
  • Training + simulations periodically; an easy report button and fast SOC response.
  • Detection of look-alike (typosquatting) domains and blocking; isolate the click (remote browsing).

Real-world cases

Section titled “Real-world cases”
  • BEC: billions in cumulative losses per IC3/FBI; email fraud without malware.
  • Google/Facebook (2013-2015): BEC that diverted ~$100M with fake vendor invoices.
  • Ukraine / APT: spear-phishing as initial access in high-profile campaigns (see MITRE ATT&CK).
  • MFA-theft campaigns with Evilginx/EvilProxy (real-time session phishing) widespread.

Testing checklist

Section titled “Testing checklist”
  • Written scope and authorization (target list, exclusions)
  • OSINT to personalize (spear) — see se-pretexting
  • Domain/sender and mail authentication prepared
  • Lure with a clear influence principle and imitated brand
  • Landing cloned on own infrastructure with TLS
  • Open/click/credential/report tracking configured
  • GDPR handling of captured credentials (and destruction)
  • Report aimed at training and controls

References

Section titled “References”