OPERATE
Security Education
7 Phishing Tricks Attackers Use
Recurring phishing lure patterns mapped to chain mechanics, observable signals, and response decisions.
Problem this page solves
Phishing reports often classify a message as "suspicious" but never identify the lure mechanism or the decision point it targeted. This page maps recurring lure patterns to chain stages so containment and escalation can follow observed evidence.
Reader outcome
After this page, you should be able to:
- classify common phishing lures by mechanism, not theme
- map each pattern to where it acts in the phishing chain
- choose response actions with explicit escalation gates
Mechanism-first pattern model
Use the same chain stages defined in Why Phishing Works:
Delivery -> Interaction -> Credential capture -> Session establishment -> Post-access actions
| Lure mechanic | Typical operator-facing example | Primary chain stage(s) affected |
|---|---|---|
| Authority impersonation | "IT admin" or executive sender display name | Delivery, Interaction |
| Urgency or fear compression | "Account disabled in 10 minutes" | Interaction |
| Link misdirection / lookalike domain | Branded text, attacker-controlled URL | Interaction, Credential capture |
| Attachment execution bait | Invoice, archive, or doc requiring enable-content | Interaction, Post-access actions |
| Fake security verification | "Confirm unusual login" flow | Credential capture, Session establishment |
| Conversation hijack / vendor thread spoof | Reply-like email in business-thread style | Delivery, Interaction |
| Payment or invoice workflow spoof | Bank-detail change or urgent payment request | Interaction, Post-access actions |
Pattern-to-signal table
| Pattern | Directly observable indicators |
|---|---|
| Authority impersonation | display name vs actual sender mismatch; reply-to domain divergence; unusual sending infrastructure in headers |
| Urgency or fear compression | short action deadline; threat language without case or ticket reference; pressure to avoid the normal verification path |
| Link misdirection / lookalike domain | hover target mismatch; non-canonical domain; URL redirects to a newly registered or unrelated host |
| Attachment execution bait | archive or macro-enabled file; double extension; endpoint telemetry showing open or execution attempt |
| Fake security verification | login page not on the canonical provider domain; unexpected MFA prompt context; user reports credential entry to a non-standard flow |
| Conversation hijack / vendor thread spoof | message style mimics an ongoing thread but lacks prior thread IDs; subtle sender-domain variation; request scope shift |
| Payment or invoice workflow spoof | change-of-bank-details request; off-process payment urgency; mismatch with known procurement cadence |
Practical response decisions and escalation gates
Gate definitions:
- Gate A (exposure-only): no click, no file open, no credential or MFA interaction
- Gate B (interaction): click or file open occurred, but no credential, MFA, or session evidence yet
- Gate C (account exposure likely): credential entry, MFA approval, or suspicious new session evidence
- Gate D (high impact): privileged account, multi-user spread, or financial workflow impact
| Pattern | Immediate response decision | Escalation gate |
|---|---|---|
| Authority impersonation | preserve email headers, verify sender through a known channel, block sender or domain indicators | Gate B if the user engaged; Gate D if a privileged or finance approver was impersonated |
| Urgency or fear compression | pause the requested action, validate the claim in a trusted portal, preserve the message timeline | Gate B on click or open; Gate C on credential or MFA interaction |
| Link misdirection / lookalike domain | resolve the URL safely, preserve the redirect chain, block the destination and lookalikes | Gate B on click; Gate C if credentials were entered or an auth prompt was approved |
| Attachment execution bait | quarantine the sample, collect the hash, review the endpoint process tree and child execution | Gate C if execution evidence exists; Gate D if multiple endpoints or a privileged host are involved |
| Fake security verification | collect fake-page artifacts, review sign-in logs, revoke suspicious sessions | Gate C when credential, MFA, or session evidence appears; Gate D for admin-account impact |
| Conversation hijack / vendor thread spoof | preserve full thread metadata, verify the request out-of-band, monitor downstream recipients | Gate C if sensitive data was shared; Gate D if spread or payment workflow changed |
| Payment or invoice workflow spoof | hold the transaction or change request, verify the beneficiary through a known contact path, preserve the approval trail | Gate D on any initiated transfer, account-change execution, or finance-system impact |
What WitnessOps can support vs cannot guarantee
WitnessOps can support:
- Phishing Investigation for governed triage, artifact capture, and containment sequence
- What Evidence Is Required? for decision completeness before intrusive action
- Policy Gates for approval controls on high-impact response steps
- Sensitive Artifact Handling for controlled handling of emails, URLs, and credential-related artifacts
- Receipts for signed decision and remediation traceability
WitnessOps cannot guarantee:
- prevention of all phishing delivery attempts
- full reconstruction when required telemetry is missing, delayed, or altered
- attacker intent or attribution from a single lure artifact
- recovery of external financial transfers without third-party process outcomes
Observed vs inferred separation
- Observed: sender or header mismatch, resolved URL, file hash, click or open telemetry, sign-in or session log, payment-change request artifact.
- Inferred: "credentials were definitely stolen," "the attacker had mailbox control," or "the full blast radius is known."
Use observed artifacts to justify immediate containment. Keep inferred claims explicit until corroborated.
Trust assumptions and limits
Assumptions:
- email, endpoint, identity, and finance telemetry is retained and time-aligned enough for sequence reconstruction
- original artifacts are preserved before mailbox cleanup or endpoint remediation
- responder actions follow policy gates when tenant-wide, privileged, or financial-impact steps are proposed
Limits:
- delayed reporting can remove short-lived artifacts such as redirect chains, ephemeral pages, or transient sessions
- adversaries may evade, suppress, or overwrite telemetry
- some scope decisions remain probabilistic until additional corroborating evidence is collected
Next-page handoff
Continue to A Real Phishing Email for a line-by-line lure walkthrough using this same observed-signal and escalation model.