Phishing Attacks & Social Engineering

Overview

Phishing is the most common cyberattack method today. Attackers use deceptive emails to trick recipients into revealing sensitive information, clicking malicious links, or transferring money. According to the APWG Phishing Activity Trends Report, over 5 million phishing attacks were detected in 2024 alone. This tutorial covers Phishing, Spear Phishing, and Business Email Compromise (BEC) — ranging from mass-scale attacks to highly targeted operations.

Table of Contents

Part 1: Phishing — The Basics

• 1.1 What is Phishing?
• 1.2 The Psychology of Phishing — Why It Works
• 1.3 Anatomy of a Phishing Email — Detailed Breakdown
• 1.4 Red Flags — How to Spot Phishing
• 1.5 Types of Phishing — Detailed Breakdown
• 1.6 Phishing Kits — Inside the Attacker's Toolbox
• 1.7 Real-World Phishing Example: The Google Docs Attack (2017)

Part 2: Spear Phishing

• 2.1 What is Spear Phishing?
• 2.2 The Spear Phishing Reconnaissance Process
• 2.3 Spear Phishing Examples — Realistic Scenarios
• 2.4 Why Spear Phishing is So Dangerous
• 2.5 Spear Phishing Case Study: Ubiquiti Networks (2015)

Part 3: Business Email Compromise (BEC)

• 3.1 What is BEC?
• 3.2 BEC Attack Types — Complete Breakdown
• 3.3 Real-World BEC Examples
• 3.4 BEC by the Numbers
• 3.5 The BEC Attack Lifecycle — Step by Step
• 3.6 Why BEC is Particularly Dangerous

Part 4: Protection & Prevention — Complete Guide

• 4.1 How to Protect Against Phishing Attacks
• 4.2 BEC Prevention Strategies for Organizations
• 4.3 Technology Defenses — How They Work
• 4.4 What To Do If You Suspect a Phishing Email — Step by Step
• 4.5 What To Do If You Fell For a Phishing Attack — Emergency Response
• 4.6 Security Awareness Training — Building a Human Firewall

Part 1: Phishing — The Basics

1.1 What is Phishing?

Phishing is a cyberattack where criminals send fraudulent emails that appear to come from legitimate sources (banks, social media platforms, government agencies, etc.) to trick recipients into:

• Revealing passwords or credit card numbers
• Clicking malicious links that lead to fake login pages
• Opening infected attachments that install malware
• Transferring money to attacker-controlled accounts
• Providing personal information (SSN, DOB, address, etc.)

The term "phishing" was coined in the mid-1990s by hackers who were "fishing" for AOL account passwords. The "ph" is a nod to the earlier term "phreaking" (phone hacking).

1.2 The Psychology of Phishing — Why It Works

Phishing exploits cognitive biases — shortcuts in human thinking that attackers manipulate:

1.3 Anatomy of a Phishing Email — Detailed Breakdown

┌────────────────────────────────────────────────────────┐
│  From:    support@secure-bank-verify.com               │  ← Suspicious domain
│  Subject: Urgent: Your Account Has Been Locked         │  ← Creates urgency
│                                                        │
│  ┌────────────────────────────────────────────────┐    │
│  │                                                │    │
│  │  [BANK LOGO — often copied from real site]     │    │
│  │                                                │    │
│  └────────────────────────────────────────────────┘    │
│                                                        │
│  Dear Valued Customer,                          ← Generic greeting
│                                                        │
│  We detected unusual login activity on your account     │
│  from an unrecognized device. To protect your funds,   │
│  we have temporarily limited your account access.      │
│                                                        │
│  ⚠ ACTION REQUIRED: Verify your identity within        │
│    24 hours or your account will be permanently        │
│    suspended.                                          │
│                                                        │
│  ┌─────────────────────────────────────────┐           │
│  │                                         │           │
│  │     [ VERIFY ACCOUNT NOW ]              │  ← Fake   │
│  │                                         │           │
│  └─────────────────────────────────────────┘           │
│                                                        │
│  Actual link: https://secure-bank-verify.tk/login      │  ← Fake URL
│  Displayed:  https://realbank.com/security             │
│                                                        │
│  Regards,                                              │
│  Security Team, National Bank                          │
│  ┌─────────────────────────────────────────┐           │
│  │ © 2025 National Bank. All rights        │           │
│  │ reserved. This is an automated          │           │
│  │ security notification.                  │           │
│  └─────────────────────────────────────────┘           │
└────────────────────────────────────────────────────────┘

Red Flags Identified:
  1. ❌ Suspicious domain (secure-bank-verify.com ≠ realbank.com)
  2. ❌ Generic greeting ("Valued Customer")
  3. ❌ Creates false urgency (24 hours)
  4. ❌ Threatens negative consequence (account suspended)
  5. ❌ Mismatched link (text says realbank.com, goes to fake site)
  6. ❌ Request for personal verification

1.4 Red Flags — How to Spot Phishing

1.5 Types of Phishing — Detailed Breakdown

1.6 Phishing Kits — Inside the Attacker's Toolbox

Attackers use phishing kits — pre-built packages sold on dark web forums that make it easy for anyone to launch phishing attacks:

Typical Phishing Kit Contents:
  📁 /phishing-kit/
    ├── index.html          ← Fake login page (mimics Gmail, Outlook, bank, etc.)
    ├── style.css           ← Stolen CSS from the real website
    ├── images/             ← Logos and icons scraped from the real site
    ├── capture.php         ← Script that saves credentials to a file
    ├── capture.txt         ← Stolen credentials accumulate here
    ├── redirect.php        ← Redirects victim to real site after capture
    ├── .htaccess           ← Blocks security bots and crawlers
    ├── /admin/             ← Panel to view stolen credentials
    │   ├── index.php
    │   └── logs.php
    ├── /telegram/          ← Sends stolen data to Telegram bot in real-time
    └── README.txt          ← Setup instructions (hosting, domain, etc.)

Cost on Dark Web:
  Basic phishing kit:        $50 — $200
  Premium kit with 2FA Bypass: $500 — $2,000
  Custom engineered kit:     $2,000 — $10,000+

💡 Some advanced kits include real-time 2FA bypass using a reverse proxy: the victim logs in through the attacker's server which forwards credentials to the real site in real-time. The attacker captures both the password AND the 2FA code.

1.7 Real-World Phishing Example: The Google Docs Attack (2017)

In May 2017, a sophisticated phishing attack targeted Gmail users worldwide:

Email Appeared From: A known contact (someone in your address book)
Subject:             "Documents"
Content:             "[Contact Name] has invited you to view the following
                     document. Click here to open."
Link:                Fake Google sign-in page (looked identical to real)

What Made It Advanced:
  ✅ Used real contact names from compromised accounts
  ✅ Used legitimate-looking Google URLs with open redirects
  ✅ Phishing page redirected to real Google Docs after capture
  ✅ Spread automatically by sending the email to all contacts

Impact: Over 1 million Google accounts compromised in a few hours
        Google took down the attack within approximately 1 hour

Part 2: Spear Phishing

2.1 What is Spear Phishing?

Spear Phishing is a highly targeted form of phishing where the attacker researches the victim extensively and crafts a highly personalized email. Unlike mass phishing ("spray and pray"), spear phishing uses specific details to appear completely legitimate. The investment per victim is much higher, but so is the success rate.

2.2 The Spear Phishing Reconnaissance Process

Phase 1: Target Selection
    ↓
  Who has access to valuable data or money?
    → Finance team, HR executives, IT admins, Executives

Phase 2: Information Gathering (OSINT)
    ↓
  Public sources the attacker mines:
  ┌──────────────────────────────────────────────┐
  │ LinkedIn       → Job title, department,         │
  │                   connections, skills           │
  │ Facebook       → Friends, interests, check-ins, │
  │                   vacation plans                │
  │ Twitter/X      → Recent posts, complaints,      │
  │                   who they follow               │
  │ Company Website → Org chart, team structure,    │
  │                   email format (jdoe@co.com)    │
  │ Google News    → Recent company announcements,  │
  │                   mergers, partnerships         │
  │ Data Breaches  → Leaked passwords, email lists  │
  │                     (Have I Been Pwned)         │
  │ GitHub         → Code commits, internal project │
  │                   names, employee emails         │
  └──────────────────────────────────────────────┘

Phase 3: Crafting the Email
    ↓
  Using gathered intel to create a believable message:
  ✓ Correct name and title
  ✓ References real projects and colleagues
  ✓ Mimics internal communication style
  ✓ Uses company-specific terminology
  ✓ Matches timezone and working hours

Phase 4: Delivery
    ↓
  Send at the optimal time (usually Tuesday-Thursday,
  9-11 AM local time when people are most productive)

Phase 5: Exploitation
    ↓
  Victim clicks → Credentials stolen / Malware installed / Money transferred

2.3 Spear Phishing Examples — Realistic Scenarios

2.4 Why Spear Phishing is So Dangerous

Comparison: Mass Phishing vs Spear Phishing

                    Mass Phishing        Spear Phishing
                    ─────────────        ─────────────
Emails Sent:        1,000,000            100
Time to Craft:      5 minutes            2-5 hours
Personalization:    None                 Extensive research
Success Rate:       ~0.1% - 3%          30% - 60%
Detection:          Easy (filters)       Hard (bypasses filters)
Target Value:       Any user             Specific high-value user
Damage per Attack:  $100 - $500          $10,000 - $100,000+

• 🔴 Highly convincing — uses real personal details that build trust
• 🔴 Bypasses generic filters — unique content escapes signature-based spam detection
• 🔴 Low volume — fewer emails mean less chance of being flagged
• 🔴 High success rate — 10-20x more effective than mass phishing
• 🔴 Weaponizes trust — exploits your real relationships and work context

2.5 Spear Phishing Case Study: Ubiquiti Networks (2015)

Company:  Ubiquiti Networks (tech company, $1B+ revenue)
Attack:   Spear phishing + CEO Fraud
Method:   Attacker posed as executives requesting wire transfers

Timeline:
  Jan 2015: Attackers research Ubiquiti's finance team on LinkedIn
  Feb 2015: Fake emails sent to finance, impersonating company lawyers
  Mar 2015: Finance processes multiple wire transfers to attacker accounts
  Jun 2015: Discovery — company realizes $46.7 million was stolen
  Result:  FBI recovered most funds, but Ubiquiti lost millions in costs

Key Lesson: Even a technology company with advanced security fell victim
             to a well-crafted spear phishing attack.

Part 3: Business Email Compromise (BEC)

3.1 What is BEC?

Business Email Compromise (BEC) — also known as CEO Fraud or Email Account Compromise — is a sophisticated scam targeting companies who conduct wire transfers and work with foreign suppliers. Attackers impersonate executives, vendors, or trusted partners to trick employees into making fraudulent payments. According to the FBI IC3 report, BEC attacks have resulted in over $55 billion in losses globally between 2013 and 2023.

3.2 BEC Attack Types — Complete Breakdown

3.3 Real-World BEC Examples

Example 1: CEO Fraud — $85,000 Near Miss

Email To:        Susan (Finance Manager)
From Display:    Mark Adams, CEO
From Address:    m.adams@cornpany.com (look-alike: 'rn' instead of 'm')
Subject:         Urgent — Acme Acquisition

Body:
Susan,

I'm in a closed-door meeting with our legal team finalizing the
Acme acquisition. We need to wire $85,000 to our escrow attorney
by 3 PM today. I'll text you the wire details shortly.

Keep this strictly confidential — my phone is off and I don't
want any leaks. Confirm receipt.

Mark

Why It Worked:
  • Urgency (3 PM deadline) → No time to verify
  • Authority (CEO) → Difficult to question
  • Confidentiality → Prevents discussion with colleagues
  • Look-alike domain → Hard to spot

Example 2: Fake Invoice — Toyota BEC (2019)

Attack:  Fraudsters impersonated a Toyota supplier
Method:  Sent fake invoices to Toyota's accounting department
         with updated "bank account details"
Loss:    $37 million (before detection)
         (Majority was recovered)

Lesson:  Even Fortune 500 companies with dedicated security
         teams can fall victim to well-crafted BEC attacks.

3.4 BEC by the Numbers

3.5 The BEC Attack Lifecycle — Step by Step

Phase 1: RECONNAISSANCE (Days 1-5)
  • Identify target company and key personnel
  • Map org structure: CEO, CFO, Finance Manager, Vendors
  • Research email formats: firstname.lastname@company.com
  • Gather publicly available info (LinkedIn, website)

Phase 2: SPOOF or COMPROMISE (Days 3-10)
  • Register look-alike domain (cornpany.com vs company.com)
  OR
  • Send credential harvesting email to compromise a real account
  • Set up mailbox forwarding rules to hide activity

Phase 3: CRAFT (Days 5-15)
  • Write email matching the executive's communication style
  • Use urgency, authority, and confidentiality
  • Specify exact amount, account, and deadline

Phase 4: SEND (Day 10-20)
  • Send to the right person at the right time
  • Follow up if no response (reinforce urgency)

Phase 5: COLLECT (Minutes after transfer)
  • Funds are immediately moved through multiple accounts
  • Often converted to cryptocurrency (irreversible)
  • Mule accounts are used to obscure trail

Phase 6: DISAPPEAR (After collection)
  • Domain is abandoned
  • Email accounts deleted
  • Mules withdraw and disappear

3.6 Why BEC is Particularly Dangerous

Part 4: Protection & Prevention — Complete Guide

4.1 How to Protect Against Phishing Attacks

4.2 BEC Prevention Strategies for Organizations

4.3 Technology Defenses — How They Work

4.4 What To Do If You Suspect a Phishing Email — Step by Step

┌─────────────────────────────────────────────────────┐
│           SUSPICIOUS EMAIL DETECTED                 │
└─────────────────────────────────────────────────────┘
                          ↓
    ┌─────────────────────────────────────────────────┐
    │  1. DO NOT click any links or open attachments   │
    │  2. DO NOT reply to the email                    │
    │  3. DO NOT forward it to anyone (yet)             │
    └─────────────────────────────────────────────────┘
                          ↓
    ┌─────────────────────────────────────────────────┐
    │  4. HOVER over links to inspect the real URL     │
    │  5. CHECK the sender's full email address         │
    │  6. CHECK Reply-To vs From address               │
    └─────────────────────────────────────────────────┘
                          ↓
    ┌─────────────────────────────────────────────────┐
    │  If confirmed as phishing:                       │
    │  7. REPORT to your IT/security team              │
    │  8. FORWARD to anti-phishing organizations:      │
    │     → reportphishing@apwg.org (US)               │
    │     → report@phishing.gov.uk (UK)                │
    │     → phishing-report@us-cert.gov (CISA)         │
    │  9. REPORT to the platform:                      │
    │     → Gmail: ⋮ → Report phishing                │
    │     → Outlook: Report → Report phishing         │
    │  10. DELETE the email                            │
    └─────────────────────────────────────────────────┘

4.5 What To Do If You Fell For a Phishing Attack — Emergency Response

🚨 Immediate Action Plan (within first 5 minutes):

4.6 Security Awareness Training — Building a Human Firewall

Organizations should conduct regular security awareness training covering:

Training Topics:
  ┌─────────────────────────────────────────┐
  │ 📘 Module 1: Recognizing Phishing Emails   │
  │    • Red flags and warning signs          │
  │    • Anatomy of a phishing email          │
  │    • Interactive email review exercise    │
  ├─────────────────────────────────────────┤
  │ 📘 Module 2: Safe Browsing & Links         │
  │    • How to inspect URLs                  │
  │    • URL shortener dangers                │
  │    • Password manager auto-fill benefits  │
  ├─────────────────────────────────────────┤
  │ 📘 Module 3: BEC & CEO Fraud               │
  │    • Real-world case studies              │
  │    • Out-of-band verification protocol    │
  │    • Payment approval processes           │
  ├─────────────────────────────────────────┤
  │ 📘 Module 4: Reporting & Response          │
  │    • How to report suspicious emails      │
  │    • Incident response procedures         │
  │    • No-blame culture (reward reporting)  │
  └─────────────────────────────────────────┘

Frequency: Every 3 months (quarterly)
Simulations: Phishing simulation campaigns every 1-2 months
Metrics: Track click rates and reporting rates over time

📝 Practice Questions

1. What's the difference between phishing and spear phishing? Include success rate comparisons.
2. Why is BEC particularly dangerous for businesses? List at least 5 reasons.
3. List 8 red flags of a phishing email with concrete examples of each.
4. What is "out-of-band verification" and why is it important for BEC prevention?
5. What immediate steps should you take in the first 5 minutes after falling for a phishing attack?
6. How do cognitive biases make people vulnerable to phishing? Name 5 biases.
7. What is a phishing kit and what does it typically contain?
8. How did the Ubiquiti Networks BEC attack work, and what can we learn from it?
9. What is the difference between SPF, DKIM, and DMARC in preventing email fraud?
10. Why is BEC particularly hard to detect compared to traditional phishing?