How phishing works: the anatomy of an attack

Most descriptions of phishing start and end with the email. That is the visible part, but it is stage three of five, and the other four explain almost everything about why the message looks the way it does.

Stage 1 — Targeting

Before anything is written, the attacker needs addresses.

For bulk phishing, these come from breach corpora, data brokers, or scraped public sources, and they are inexpensive. That economics point matters more than it sounds: when a list of millions costs very little, the campaign does not need to be convincing to most people. It needs to be convincing to a fraction of a percent.

For spear phishing, targeting is the expensive stage. The attacker researches an individual — employer, colleagues, recent posts, a supplier relationship — because the return justifies the effort.

Stage 2 — The pretext

The pretext is the story: why this message exists and why you must act.

Good pretexts share three properties. They are plausible (something you might genuinely receive), time-bound (a reason to act now), and they demand one small action rather than a large one. The classics endure because they satisfy all three — a delivery needing an address correction, a password reset you did not request, an invoice, a shared document, an unpaid toll.

Notice that none of these are dramatic. Dramatic pretexts get scrutinised.

Stage 3 — Delivery

The channel is chosen for where the defences are weakest.

The APWG notes attackers sending millions of emails a day containing QR codes, specifically because a QR code defeats the "hover and read the link" habit that a decade of training established. Every shift in channel follows that logic: find the place where the learned defence does not apply.

Stage 4 — Capture

This is where the theft actually happens, and it is the stage that has changed most.

The old model was a static copy of a login page, which meant imperfections you could spot. The current model is a live proxy. The fake page forwards your credentials to the genuine site in real time, and relays the genuine site's responses back to you.

The consequences are worth stating plainly:

• The page looks exactly right, because much of it is the real page.
• Your one-time code arrives genuinely, from the real service, because a real login attempt is happening.
• Entering that code hands the attacker a valid authenticated session.

Stage 5 — Exploitation

What happens next depends on what was captured.

A stolen password gets tried across other services immediately — see credential stuffing — because reuse is common enough to make it worthwhile. A captured session is used before it expires. A compromised email account is particularly valuable, because it is the reset mechanism for everything else.

Access is also frequently sold rather than used. The person who phished you and the person who eventually drains an account are often not the same party, which is why the consequence can arrive weeks later.

Where the chain actually breaks

Each stage has a defence, and they are not equally practical.

The row in bold is the one worth building a habit around. Everything upstream of it is probabilistic; that step is categorical. If you never act using the contact details a message supplied — if you close it and reach the organisation yourself — the remaining stages have nothing to work with, no matter how good the pretext was.