Modern phishing targets predictable habits: hurry, trust in logos and the way people deal with urgent requests. The aim is not always just a password. Attackers want something more valuable: an active session they can reuse to act as you, with your permissions and access.
That makes social engineering the easiest first step. Get the user to act, then use that action to move quietly inside an organisation.
The traditional approach: fake login pages
A common start looks like this: an email that seems to come from your IT team, from Microsoft, or from a colleague. You click a link and land on what appears to be a legitimate Microsoft sign-in page. The page asks for username and password and captures what you type.
In days gone by, those credentials were often enough. Today, multi-factor authentication (MFA) is widely used, so simply stealing a password is often not enough to gain ongoing access.
The modern approach: session hijacking and token theft
When you log in, the service issues tokens or session cookies. Those tokens are the proof that you already passed MFA and are allowed in. If an attacker can capture those tokens they can use them to access services as you would, without needing the password again.
That is why some phishing attacks focus on capturing tokens rather than only collecting passwords. Tokens can be replayed or imported into another session until they expire or are revoked.
Proxy attacks in broad terms
Proxy-style phishing does not simply show a fake page. From the victim’s point of view, they are seeing a legitimate login flow. Behind the scenes a proxy relays real content from the service while also capturing responses and tokens. Defenders have written about these techniques because they are widely used against organisations, but the coverage stays at a high level so that defenders know what to look for.
Key signals defenders should log include rapid token issuance and reuse, browser fingerprints that change during a single session, and authentication traffic routed through unusual domains or IPs.
What attackers do next
Once an attacker has access they follow a familiar pattern:
Import a stolen session into their own browser and inspect the account
Read mail to learn who does what and how payments are handled
Search for sensitive documents and attachments to download
Create forwarding rules or inbox rules that hide alerts or copy mail externally
Register application consents that give persistent access to mail and files
Move laterally to shared mailboxes, OneDrive, SharePoint and Teams
Set up further social engineering or business email compromise for financial gain
These activities can be quick or they can stretch over weeks or months. That is why early detection is critical.
Why this is effective
A few things make these attacks so successful:
The user sees a near perfect imitation of the real Microsoft login page
The attacker uses a valid SSL certificate, so the browser padlock appears
MFA can be bypassed if the attacker captures session material after the authentication step
There is nothing malicious to run on the victim’s device, so endpoint tools may not detect anything
Session tokens are often valid for hours or days, giving attackers a useful window
Practical defences that actually help
Some common advice is not enough on its own. Instead, use a combination of controls that make proxy attacks much harder and improve detection.
Use phishing-resistant authentication where you can, for example hardware security keys that use FIDO2/WebAuthn. These verify the domain cryptographically and block proxy attacks.
Apply Conditional Access and token protection so tokens are device bound and replay is harder. Monitor for token anomalies.
Block legacy authentication. Modern protocols are easier to monitor and control.
Shorten session lifetimes where possible. Shorter tokens reduce the window of misuse.
Log and alert on new enterprise app consents and OAuth grants. Treat broad permissions as suspicious until validated.
Monitor mail flow for unexpected forwarding and check Exchange connectors for unusual routing; malicious connectors are a growing persistence technique.
Use layered email security. We use and recommend Check Point Harmony Email and Collaboration to stop malicious links, account takeover attempts and BEC before they reach inboxes.
Use endpoint detection and combine that with realistic, short awareness training. Practical, regular exercises change behaviour more than long lectures.
The cultural defence
Technology reduces risk, but culture catches attacks early. Phishing targets habits and time pressure. Make it normal to pause, check and report. Encourage a no-blame approach so people feel safe to flag something even if they are unsure.
Training should be short, relevant and realistic. Use real examples and keep sessions brief. Pair that training with simulated exercises that help people recognise real-world lures. When reporting is routine, breaches are smaller and recovery is faster.
Explaining the attacker perspective helps you design better detection, faster response and a calmer workplace reaction.
This post is for defenders and security teams. The technical details here are high level and are intended to help detection and response, not to instruct misuse.
