Phishing: harvesting credentials at scale

Phishing remains the most common initial-access vector: it convinces a person to hand over credentials on a fake page.

From clone to proxy

Classic phishing clones the login page and harvests username/password. The modern version, with a reverse proxy (evilginx, Modlishka), sits in the middle between victim and real site: it intercepts credentials and the post-MFA session cookie, bypassing two-factor authentication.

victim -> attacker proxy -> real site
          ^ captures credentials + session cookie (MFA already passed)

Defence

Phishing-resistant MFA: WebAuthn/passkeys/FIDO2 bind authentication to the origin, so the proxy fails. Email filtering (SPF/DKIM/DMARC for sender spoofing), training, and detection: newly registered look-alike domains, links to unexpected origins. Conditional access (trusted device, geolocation).