How Hackers Conduct Phishing Attacks: The Full Attack Lifecycle

Most people picture phishing as a single moment — a suspicious email lands in an inbox. In reality, a phishing attack is a multi-stage operation with reconnaissance, infrastructure setup, delivery, and post-compromise phases, each mirroring standard project workflow more than most people expect. Understanding the full lifecycle, the way MITRE ATT&CK documents it, is what actually helps defenders interrupt it — because every stage is a separate opportunity for detection.

The Phishing Attack Lifecycle

flowchart TD
    A["Reconnaissance"] --> B["Infrastructure Setup"]
    B --> C["Lure Creation"]
    C --> D["Delivery"]
    D --> E["Victim Interaction"]
    E --> F{"Success?"}
    F -->|Yes| G["Credential or Access Capture"]
    F -->|No| H["Attempt Failed or Detected"]
    G --> I["Post-Compromise Actions"]
    I --> J["Account Takeover<br/>Lateral Movement<br/>Data Theft<br/>Fraud"]

Stage 1: Reconnaissance

Before sending anything, attackers gather context to make the lure believable. For mass-market phishing, this is minimal — a purchased email list and a generic pretext (“your package couldn’t be delivered”) is enough. For targeted phishing (spear phishing) or whaling attacks against executives, reconnaissance is far more deliberate: attackers study LinkedIn profiles, company org charts, press releases, and even out-of-office replies to learn reporting relationships, current projects, and communication style. Business Email Compromise (BEC) campaigns, which the FBI’s Internet Crime Complaint Center consistently ranks among the costliest cybercrime categories by dollar loss, rely heavily on this reconnaissance phase to impersonate a CFO or vendor convincingly.

Stage 2: Infrastructure Setup

This includes registering lookalike or typosquatted domains, standing up hosting (sometimes on compromised legitimate servers to inherit an existing good reputation), obtaining a TLS certificate, and configuring an email-sending capability — either through a compromised legitimate mail account (which bypasses sender authentication checks entirely) or through spoofing techniques against domains with weak SPF/DKIM/DMARC configuration.

Stage 3: Lure Creation

The lure is the pretext and the artifact — the email copy, the cloned login page, the malicious attachment, or the QR code (in “quishing” attacks). Effective lures exploit a small set of consistent psychological levers:

Stage 4: Delivery

Delivery channels have diversified well beyond email:

• Email phishing — still the dominant channel by volume.
• SMS phishing (smishing) — exploits the smaller screen and reduced scrutiny on mobile, often impersonating delivery services or banks.
• Voice phishing (vishing) — live or AI-voice-cloned calls, increasingly effective given generative voice synthesis advances.
• Social media and messaging app phishing — impersonation accounts, fake customer support DMs, malicious ads.
• QR code phishing (quishing) — embeds the malicious URL in a QR code to bypass email link-scanning security tools that only inspect plain-text URLs.

Stage 5–6: Victim Interaction and Capture

Once a victim clicks through, the mechanics depend on attack type: a credential-harvesting page captures typed credentials; a malicious attachment may execute a macro or exploit to drop malware; an OAuth consent phishing attack (a technique that surged with cloud SaaS adoption) tricks the victim into granting a malicious third-party app permissions to their real account — notably, this bypasses password-based defenses and even some MFA entirely, since the victim authenticates normally and simply grants scoped access to an attacker-controlled application.

sequenceDiagram
    participant Victim
    participant MaliciousApp as Attacker's OAuth App
    participant RealProvider as Legitimate Identity Provider
    Victim->>MaliciousApp: Clicks "Sign in with Google/Microsoft"
    MaliciousApp->>RealProvider: Redirects to real OAuth consent screen
    RealProvider->>Victim: "This app wants access to your mail/files"
    Victim->>RealProvider: Approves (thinks it's a legitimate integration)
    RealProvider->>MaliciousApp: Issues OAuth token
    MaliciousApp->>RealProvider: Uses token to access victim's data

Stage 7: Post-Compromise Actions

Captured credentials or tokens rarely end the attack — they start the next phase. Common outcomes documented in incident response reports include:

• Account takeover and further internal phishing sent from the compromised legitimate account (a technique that dramatically increases the credibility of subsequent phishing waves).
• Business Email Compromise fraud — redirecting invoice payments to attacker-controlled accounts.
• Lateral movement into connected systems using the same or reused credentials.
• Data exfiltration for extortion or resale.
• Ransomware deployment, since phishing remains one of the top initial access vectors documented in ransomware incident reports across the industry.

Comparing Phishing Attack Types

Defensive Workflow Mapped to the Attack Lifecycle

Common Mistakes Organizations Make

• Treating phishing defense as purely a technical email-filtering problem, ignoring SMS, voice, and OAuth-based vectors.
• Assuming MFA alone is sufficient — MFA fatigue attacks (repeated push notifications until a victim approves out of annoyance) and OAuth consent phishing both bypass traditional password-plus-MFA models.
• Underinvesting in incident response speed for the post-compromise phase, where damage actually accrues.
• Failing to restrict or audit third-party OAuth application permissions granted by users.

FAQs

Q: Is email still the primary phishing delivery channel? Yes, by volume, though SMS, voice, and social-media-based phishing have grown significantly, partly because they bypass mature email security filtering.

Q: How does OAuth consent phishing bypass MFA? The victim authenticates through the real identity provider using their normal credentials and MFA, then grants a malicious third-party application scoped access — the attacker never needs the password or MFA code at all, only the token issued after consent.

Q: What’s the single highest-leverage defensive investment? Phishing-resistant MFA (FIDO2/WebAuthn or passkeys) combined with rapid incident response processes for the post-compromise phase, since no single control stops every stage of the lifecycle.

Summary and Recommendations

Phishing succeeds because it’s a full lifecycle attack, not a single email — and every stage from reconnaissance through post-compromise action offers a distinct defensive opportunity. Effective defense means mapping controls to each stage rather than relying on a single layer like email filtering or awareness training alone.

Further reading:

• MITRE ATT&CK — T1566 (Phishing) and sub-techniques
• NIST SP 800-63B — Digital Identity Guidelines
• CISA — Phishing Guidance and Resources
• FBI IC3 — Business Email Compromise reporting and statistics
• OWASP — Phishing Cheat Sheet