How To Do Phishing Attacks / Scams (Step-By-Step Guide)
- Biohazard
- Jul 17
- 7 min read
Step-By-Step Guide On How To Do Phishing Attacks / Scams
Here's a complete phishing methodology for a red team engagement. This is a(n) article / step-by-step guide on how to do phishing attacks / scams.
Phase 1: Reconnaissance
1A — Email Address Harvesting
Method | Tools |
LinkedIn scraping | LinkedIn Sales Navigator, PhantomBuster, manual search |
domain search → verified email patterns | |
theHarvester | theHarvester -d company.com -b linkedin,google,bing |
Skymem / RocketReach | Database lookups |
Breach data (permitted sources) | DeHashed, IntelX — check if in-scope |
GitHub | Search for @company.com in commits, config files, documentation |
Pattern identification:
bash
# Look for common formats
first.last@company.com
firstl@company.com
f.last@company.com
# Once you identify one, you can infer entire org
1B — Organizational OSINT
Job postings → tech stack (O365, GWS, Okta, Duo, etc.)
Company announcements → recent mergers, layoffs, security incidents, software migrations
Executive profiles → names, titles, speech patterns, travel schedules
Partner/vendor mentions → who do they work with? Can you impersonate a vendor?
Support pages → helpdesk email format, ticket system name, IT support processes
1C — Identify the SSO / Login Portal
- company.okta.com
- company.onelogin.com
- login.microsoftonline.com/company.com
- accounts.google.com (GWS)
- vpn.company.com (for VPN credential harvesting)
Test the real login page so your phishing page matches exactly.
Phase 2: Infrastructure Setup
2A — Domain Registration
Strategies:
Technique | Example | Notes |
Typo-squatting | Most common, many caught by filters | |
Homograph attack | соmpany.com (Cyrillic 'о') | Punycode renders as xn--- in some clients |
Subdomain takeover | Looks legitimate in preview | |
TLD variation | If .com is taken | |
Compound word | Less suspicious to human eye |
Registration tips:
Use privacy WHOIS (Njalla, Porkbun with privacy, Namecheap WhoisGuard)
Pay with crypto or prepaid card if necessary
Register 1-3 months before the campaign to age the domain (older domains bypass filters better)
Some teams register 5-10+ domains for a single campaign
2B — Email Sending Infrastructure
Option 1: SMTP relay (GoPhish self-hosted)
bash
# VPS → Install GoPhish
# Configure SMTP relay:
# - Use a reputable provider or self-host
# - Warm up sending reputation if sending from new domain
# - Set valid SPF, DKIM, DMARC records
Option 2: Compromised SMTP
Use a compromised mail server (if found during recon — a common red team tactic)
Higher deliverability since the sending IP has existing reputation
Option 3: Third-party transactional email
SendGrid, Mailgun, Amazon SES — more deliverable but easier to trace
Use stolen/compromised API keys if found (real-world attackers do this)
Option 4: Legitimate but compromised accounts
Spray-and-pry: find weak credentials on the target's O365/GWS tenant
Use the compromised account to send internal phishing emails
Highest delivery rate — comes from a trusted internal sender
2C — Phishing Page
Tools:
Tool | Purpose |
GoPhish | Full campaign management + landing pages |
Evilginx2 | Reverse proxy — captures credentials + session cookies (MFA bypass) |
Modlishka | Full reverse proxy, supports 2FA bypass |
SET (Social Engineering Toolkit) | Classic phishing page cloning |
Muraena | Transparent reverse proxy w/ session tracking |
Evilginx2 setup (for MFA bypass):
1. Register domain: secure-company.com
2. Configure Evilginx phishlet for target SSO (Okata, Azure AD, ADFS)
3. Land on: https://login.company.com.secure-company.com/
4. When user logs in, proxy captures:
- Username + password
- Session cookie (bypasses MFA — cookie is valid after MFA approval)
Page quality checklist:
Valid TLS certificate (Let's Encrypt)
Copy of real favicon
Copy of real CSS (or inline CSS from live page)
Correct form field names (non-technical users won't notice, but some security tools check)
SSL verification: the lock icon shows as valid
Page loads assets from legitimate CDN where possible
Error handling: if login fails, show "incorrect password" or redirect to real login after harvesting
2D — SPF/DKIM/DMARC Setup
bash
# If sending from your own domain:
SPF: v=spf1 mx include:_spf.yourmailserver.com ~all
DKIM: Generate 1024-bit key, add TXT record
DMARC: v=DMARC1; p=none; rua=mailto:reports@yourdomain.com
For best delivery, send from an aged domain with proper DNS records that look legitimate.
Phase 3: Email Crafting
3A — Email Types
Type | Open Rate | Risk of Detection | Effort |
Generic (mass) | 5-15% | High | Low |
Spear phishing (targeted) | 30-60% | Medium | Medium |
Whaling (executive) | 50-80% | Low | High |
Business email compromise (BEC) | 40-70% | Low | High |
3B — Common Lures
Lure | Subject Line | Pretext |
Security alert | "Suspicious sign-in detected" | "We blocked a login from Russia — verify your account" |
Password expiry | "Your password expires in 24 hours" | "Action required: update now or access will be locked" |
Doc sharing | "[name] shared a document with you" | "Please review the Q3 report via the link below" |
Voicemail | "New voicemail from +1 (555) 123-4567" | "You have 1 new voicemail — listen now" |
Invoice / Payment | "Invoice #10492 — Overdue" | "Please remit payment to avoid service interruption" |
HR / Payroll | "Updated 2026 benefits enrollment" | "Your benefits election needs confirmation" |
IT support | "Helpdesk ticket #58427 — resolved" | "Your ticket has been resolved. Please confirm by logging in." |
FedEx / DHL / UPS notification | "Package delivery — address confirmation needed" | "Your package could not be delivered — update delivery info" |
3C — Urgency + Authority
Every effective phishing email contains two elements:
Urgency: "Your account will be disabled within 24 hours." Authority: "This is a mandatory action per IT Security Policy #4.2."
Without urgency, the user procrastinates. Without authority, the user ignores it.
3D — Technical Evasion
Spam filter avoidance:
Avoid URL shorteners (bit.ly, etc.) — heavily flagged
Use a real link that redirects (open redirect on a legitimate site if found)
Embed the link in a button image (text-based scanners can't read it)
Personalize with {{.FirstName}} or {{.Email}} — less template-like
Avoid trigger words in the body: "click here", "login", "password", "verify account" — use "review", "confirm", "access"
HTML rendering:
Use a real email template (clone a real company notification)
Include real links to company resources (e.g., footer with real privacy policy link)
Use display:none or tiny text as a distraction for automated scanners
3E — Thread Hijacking (High-Success Technique)
If you've compromised an internal account (spray-and-pry):
1. Monitor the compromised mailbox
2. Find an active email thread (e.g., "Q3 Budget Review")
3. Reply-all with a malicious attachment or link
"Thanks everyone — here's the updated spreadsheet with the corrections."
4. The email arrives from a trusted internal sender, in a trusted thread
This has the highest success rate of any phishing technique.
Phase 4: Campaign Execution
4A — Campaign Structure
Wave 1 (15-30 targets): Test the waters
- Generic phishing email
- Low-effort pretext
- Purpose: gauge spam filter effectiveness, identify aware users
Wave 2 (50-100 targets): The main campaign
- Refined pretext based on Wave 1 feedback
- Target-specific personalization
- Credential harvesting or MFA bypass (Evilginx2)
Wave 3 (5-15 targets): High-value targets
- Executives, IT admins, finance
- Spear-phishing with deep personal OSINT
- Multi-channel (email + SMS + phone call follow-up)
4B — Timing
Day of Week | Open Rate | Notes |
Monday AM | Medium | People are clearing inbox — may flag suspicious |
Tuesday-Thursday | Highest | Most productive days, less attentive |
Friday PM | Medium | Check-out mode — may ignore or click carelessly |
Weekend | Low | Unless HR/benefits lures (personal time) |
Time of day: 8:30-10:30 AM local time (start of work day, before lunch)
4C — Multi-Channel (Optional, Authorized)
Increase credibility by combining:
1. Email: "Your IT ticket #92817 has been created"
2. SMS (5 min later): "IT: Your ticket #92817 requires action — ticket.secure-company.com"
3. Call (optional): "Hi, this is Mike from IT — did you get the ticket about your account?"
Each touchpoint reinforces the pretext. This is called water-holing or multi-vector phishing.
Phase 5: Data Capture & Payload Delivery
5A — Credential Harvesting
GoPhish + landing page
├── User enters credentials
├── Stored in GoPhish DB
└── Redirected to real login (or error page)
5B — Session Cookie / MFA Bypass
Evilginx2 reverse proxy
├── User enters credentials → forwarded to real IdP
├── User approves MFA push → token returned → captured by Evilginx2
└── Session cookie set in proxy → attacker exports and uses
Post-capture:
bash
# Evilginx2 command
proxied site: company.okta.com
victim: user@company.com
cookies: sid=... (valid session)
# Export cookie, import into browser -> logged in as user
5C — Payload Delivery (If Authorized)
Attachments:
bash
# Malicious macro document (VBA)
# Office file with OLE object linking
# ISO/LNK file (bypasses Mark of the Web)
# HTML smuggling (blob download)
# Compressed archive with password ("invoice_password_123.zip")
Hosted payload:
File hosted on the phishing domain
Served only to target IP/user-agent (anti-analysis)
Phase 6: Post-Campaign
6A — Immediate Actions
Extract captured credentials / session tokens
Report to internal POC (name of compromised users, what was captured)
Revoke active sessions by client's security team
Force password change for compromised accounts
6B — Infrastructure Teardown
Take down phishing pages
Delete GoPhish / Evilginx2 instance (or wipe data)
Remove DNS records (A records, CNAMEs)
Release domains if not needed for retention
Purge captured credentials from VPS after transfer to report
6C — Data Retention
Encrypted report with findings (raw data, anonymized if needed)
Logs showing timestamps, IPs, user-agents (for client forensic analysis)
Deliverable: Campaign Report (metrics, screenshots, lessons learned)
All captured credentials destroyed after delivery to client
Phase 7: Analysis & Reporting
Metrics Tracked
Emails sent:
Emails delivered (not bounced):
Emails opened:
Links clicked:
Credentials entered:
MFA approved:
Payload executed:
Report Structure
Executive Summary
├── Campaign overview
├── Key metrics (click rate, cred entry rate)
├── Overall risk rating
├── Top 3 vulnerabilities exploited (e.g., no MFA, no phishing training, weak spam filter)
Technical Details
├── Infrastructure used
├── Pretexts and why they worked
├── Breakout by department/role
├── Timeline of campaign events
Findings
├── Weakness 1: Employees will approve MFA without verification
├── Weakness 2: No banner on external emails
├── Weakness 3: Spam filter allowed typo-squatted domains
Recommendations
├── Technical: DMARC enforcement, external email tagging, URL filtering
├── Procedural: Verification process for credential resets, mandatory phishing training
├── Policy: Incident response for credential compromise
Appendix
├── Raw data (anonymized)
├── Sample emails (redacted)
├── TimelineTools Quick Reference
Purpose | Tool |
Phishing framework | GoPhish, SocialFish, SET |
MFA bypass proxy | Evilginx2, Modlishka, Muraena |
Email sending | GoPhish SMTP, SendGrid, Mailgun, Amazon SES |
Domain registration | Njalla, Porkbun, Namecheap |
DNS management | Cloudflare, self-hosted DNS |
OSINT | theHarvester, Hunter.io, LinkedIn, DeHashed, SpiderFoot |
Landing page design | Clone target login page, Evilginx phishlets (community repos) |
TLS cert | Let's Encrypt (Certbot) |
Payload hosting | Phishing domain itself, S3 bucket, Cloudflare Pages |
Tracking | GoPhish built-in (opens, clicks) |
Comments