Phish Food: What Threat Actors Serve Employees

Your Employees Are Eating Phish Food Every Day

In March 2024, MGM Resorts was still tallying the damage from a social engineering attack that started with a single phone call. The estimated cost exceeded $100 million. The threat actor didn't exploit a zero-day vulnerability or deploy some exotic malware. They simply served up convincing phish food — a well-crafted pretexting scenario — and an employee bit.

That's the reality I've watched play out for over two decades in cybersecurity. Attackers don't need sophisticated tools when they can just cook up the right bait. Phish food is my term for the entire menu of deceptive lures that threat actors design to trick humans into handing over credentials, clicking malicious links, or wiring money to fraudulent accounts. And your employees are being served this menu every single day.

According to the Verizon 2024 Data Breach Investigations Report, 68% of breaches involved a human element — social engineering, errors, or misuse. The attackers aren't breaking down your firewall. They're walking through the front door because someone held it open for them.

When I talk about phish food, I'm not just talking about the classic Nigerian prince email. Today's threat actors run a sophisticated kitchen. Here's what's on the menu.

The Classic Phishing Email

Still the most common dish served. These emails impersonate trusted brands — Microsoft 365, DocuSign, your bank, even your own HR department. They create urgency: "Your account will be locked in 24 hours." "Approve this document before end of business." The goal is credential theft, plain and simple.

I've reviewed phishing emails that were pixel-perfect replicas of legitimate Microsoft login pages. The only giveaway was a single character difference in the URL. Most employees never look at the URL.

Spear Phishing: The Chef's Special

Generic phishing casts a wide net. Spear phishing is the chef's special — custom-prepared for a specific target. Attackers research your organization on LinkedIn, press releases, and social media. They know your CEO's name, your vendor relationships, and your internal lingo.

That's how the threat actors behind the 2020 Twitter breach operated. They targeted specific employees with phone-based social engineering, gained access to internal tools, and compromised 130 high-profile accounts. Personalized phish food is exponentially more dangerous.

Business Email Compromise (BEC)

The FBI's Internet Crime Complaint Center (IC3) reported that BEC scams accounted for over $2.9 billion in reported losses in 2023 alone. BEC is phish food at its most expensive. An attacker compromises or spoofs an executive's email account and sends a wire transfer request to the finance team. No malware. No ransomware. Just a convincing email and a sense of urgency.

You can review the FBI's own data at the IC3 Annual Report page.

Smishing and Vishing: Beyond the Inbox

Phish food isn't limited to email. SMS-based phishing (smishing) and voice phishing (vishing) are exploding. That MGM Resorts attack? It started with a phone call to the help desk. The attacker impersonated an employee, convinced the help desk agent to reset MFA credentials, and gained access to the network.

Your employees need to recognize phish food regardless of the delivery channel.

Why Your Employees Keep Taking the Bait

Here's what I've learned after running hundreds of phishing simulations across organizations of every size: the problem isn't stupidity. It's psychology.

Threat actors exploit cognitive biases that every human shares. Authority bias makes employees comply when they think the CEO is asking. Urgency bias makes them click before thinking. Social proof makes them trust an email that references a colleague. These aren't weaknesses — they're normal human responses. And attackers know exactly how to weaponize them.

The Cybersecurity and Infrastructure Security Agency (CISA) consistently emphasizes that technical controls alone aren't enough. You need layered defenses, and the human layer is the one most organizations neglect.

What Does Phish Food Look Like in 2026?

The phish food menu is evolving fast. Here's what I'm seeing right now in the threat landscape.

AI-Generated Phishing at Scale

Threat actors are using generative AI to craft phishing emails that are grammatically flawless, contextually relevant, and nearly impossible to distinguish from legitimate communications. The days of spotting a phishing email by its broken English are over. AI lets attackers produce high-quality phish food in any language, at massive scale.

Deepfake Vishing

Voice cloning technology has made vishing attacks terrifyingly effective. I've seen demonstrations where a three-second audio clip was enough to clone a voice convincingly. Imagine your CFO receiving a call from someone who sounds exactly like the CEO, requesting an emergency wire transfer. This is happening now.

MFA Fatigue Attacks

Multi-factor authentication is a critical security control, but it's not bulletproof. In MFA fatigue attacks, threat actors bombard a target with push notifications until the exhausted user approves one just to make it stop. This technique was used in the 2022 Uber breach, where a teenage hacker gained access to internal systems by pestering an employee with MFA prompts.

QR Code Phishing (Quishing)

QR codes are everywhere now — restaurant menus, parking meters, conference badges. Attackers embed malicious URLs in QR codes and distribute them via email, printed flyers, or even physical mail. Your email security gateway can't scan a QR code in a PDF attachment the way it scans a hyperlink. It's a blind spot, and attackers know it.

How Do You Stop Employees From Eating Phish Food?

This is the question I get asked most, so here's the direct answer: you build a security awareness culture through consistent training, realistic phishing simulations, and technical controls working in concert.

No single tool will solve this. You need a layered approach.

Step 1: Ongoing Security Awareness Training

Annual compliance training doesn't work. I've seen organizations check the box with a yearly PowerPoint presentation and then wonder why their click rates on phishing simulations stay above 30%. Training has to be continuous, relevant, and engaging.

Start with a comprehensive cybersecurity awareness training program that covers not just phishing but the full spectrum of social engineering tactics. Your employees need to understand the psychology behind these attacks — not just memorize a list of red flags.

Step 2: Run Phishing Simulations Regularly

You can't improve what you don't measure. Regular phishing simulations give you baseline click rates, identify high-risk departments, and reinforce training in a way that classroom instruction never can. When an employee clicks a simulated phish, that's a teachable moment — not a gotcha.

If your organization needs a structured approach to phishing simulations and targeted education, explore phishing awareness training built for organizations. It's designed to turn your weakest link into your first line of defense.

Step 3: Deploy Technical Controls That Complement Training

Training alone isn't enough either. Layer it with technical controls:

Email filtering and sandboxing to catch known phishing patterns
Multi-factor authentication on every account, using phishing-resistant methods like FIDO2 keys
Zero trust architecture that verifies every access request regardless of network location
DNS filtering to block known malicious domains
Endpoint detection and response (EDR) to catch what gets through

Zero trust isn't a product you buy. It's a philosophy: never trust, always verify. When your technical controls and your trained employees work together, you shrink the attack surface dramatically.

Step 4: Build a Reporting Culture

Your employees need to feel safe reporting suspicious messages. If they're afraid of punishment for clicking a link, they'll hide it. And a hidden compromise is far more expensive than a reported one. Celebrate the employees who report phishing attempts. Make the "Report Phish" button the most important tool in their inbox.

The $4.88M Lesson Most Organizations Learn Too Late

IBM's 2024 Cost of a Data Breach Report pegged the global average cost of a data breach at $4.88 million. Phishing was the most common initial attack vector. That's not a theoretical risk — it's the actual price tag when your employees eat the phish food.

I've worked with organizations that thought they were too small to be targeted, too niche to be interesting, or too well-protected to be breached. Every single one of them had employees who would click a well-crafted phishing email. Every one.

The difference between organizations that suffer catastrophic breaches and those that catch attacks early almost always comes down to one thing: whether their people were trained to recognize phish food before they swallowed it.

Stop Serving Easy Targets

Threat actors are in the kitchen right now, preparing phish food tailored to your organization. They're researching your employees on LinkedIn, crafting emails that mimic your vendors, and building credential-harvesting pages that look identical to your login portals.

Your move is straightforward. Train your people with real-world cybersecurity awareness training. Test them with realistic phishing simulations. Deploy technical controls that follow zero trust principles. And build a culture where reporting suspicious messages is rewarded, not punished.

The attackers only need one employee to take the bait. Your job is to make sure none of them do.