In 2023, MGM Resorts lost an estimated $100 million after a threat actor called Scattered Spider social-engineered their way past the help desk with a single phone call. But that attack started the way most do — with a phishing attack that gathered the intelligence needed to make that call convincing. The Verizon 2024 Data Breach Investigations Report found that 36% of all breaches involved phishing, making it the most common initial access vector for the second year running. If your organization hasn't been targeted yet, it will be. This post breaks down exactly how a phishing attack works, step by step, using real-world data — and what you can do right now to harden your defenses.

What Is a Phishing Attack, Exactly?

A phishing attack is a social engineering technique where a threat actor impersonates a trusted entity — a bank, a boss, a vendor — to trick someone into revealing credentials, clicking a malicious link, or downloading malware. It's not a technology problem. It's a human problem. And that's what makes it so effective.

Phishing comes in several flavors: mass email campaigns, spear phishing targeting specific individuals, smishing via text message, and vishing over the phone. The MGM incident involved vishing. But the vast majority of attacks still arrive in your inbox as plain old email.

The $4.88M Price Tag of a Single Click

IBM's 2024 Cost of a Data Breach Report pegged the global average cost of a data breach at $4.88 million — up 10% from the previous year. Phishing was identified as the most common initial attack vector in that report. One employee clicking one link can trigger a chain reaction: credential theft, lateral movement, data exfiltration, and ransomware deployment.

I've seen organizations with solid firewalls, endpoint detection, and SIEM tools still get breached because an accounts payable clerk opened a PDF that looked exactly like an invoice from their regular vendor. Technology alone doesn't stop phishing. People do.

Why Threat Actors Keep Coming Back to Phishing

Phishing is cheap. It scales effortlessly. And it works. A threat actor doesn't need to find a zero-day vulnerability when they can simply ask someone for their password — and get it. Modern phishing kits are sold as a service on dark web marketplaces, complete with templates that clone Microsoft 365 login pages pixel for pixel.

The barrier to entry is nearly zero. That's why phishing volume continues to climb. The Anti-Phishing Working Group reported over 1.2 million phishing attacks in Q3 2023 alone — and these numbers only reflect what gets reported.

Anatomy of a Phishing Attack: Step by Step

Step 1: Reconnaissance

Before sending a single email, sophisticated attackers research their targets. LinkedIn profiles, company websites, press releases, even social media posts give threat actors the information they need to craft a believable lure. They'll learn your naming conventions, identify your CFO, and figure out which vendors you use.

Step 2: The Lure

The attacker crafts an email designed to trigger urgency, fear, or curiosity. Common pretexts include:

  • "Your password expires in 24 hours — reset now"
  • "Invoice #4892 is past due — see attached"
  • "HR has updated the employee handbook — review required"
  • "Your package could not be delivered — confirm address"

The email contains either a malicious link leading to a credential harvesting page or an attachment loaded with malware. In my experience, credential theft phishing now outnumbers malware delivery by roughly three to one.

Step 3: Credential Harvest or Payload Delivery

If the victim clicks the link, they land on a page that looks identical to a legitimate login portal. They enter their username and password. The attacker captures those credentials in real time — often using a reverse proxy tool like Evilginx that can intercept multi-factor authentication tokens as well.

If the attack uses an attachment, opening it executes code that establishes a foothold. From there, the attacker moves laterally, escalates privileges, and stages the real damage — whether that's ransomware, data exfiltration, or business email compromise.

Step 4: Monetization

Stolen credentials get used immediately or sold in bulk. Business email compromise (BEC) schemes — where attackers use a compromised email account to redirect wire transfers — cost organizations $2.9 billion in 2023 according to the FBI IC3 2023 Internet Crime Report. That makes BEC the single most financially damaging category of cybercrime reported to the FBI.

Why Multi-Factor Authentication Isn't Enough Anymore

I used to tell clients that MFA was the silver bullet against credential theft. I can't say that anymore. Adversary-in-the-middle (AiTM) phishing attacks now routinely bypass traditional MFA by proxying the entire authentication session. The attacker captures both the password and the session cookie, giving them full access.

This doesn't mean you should abandon multi-factor authentication — it still stops the majority of opportunistic attacks. But you need phishing-resistant MFA, such as FIDO2 hardware keys, and you need a zero trust architecture that doesn't rely on a single authentication event to grant broad access. CISA's phishing guidance recommends exactly this layered approach.

How to Actually Defend Against a Phishing Attack

Train Your People — Then Test Them

Security awareness training isn't a checkbox exercise. It has to be continuous, relevant, and reinforced with phishing simulation campaigns that mimic the real tactics your employees will face. When I run simulations for clients, click rates typically start around 25-35%. After six months of consistent training and testing, those rates drop to 3-5%.

If you're looking for a structured program, our phishing awareness training for organizations walks employees through real-world phishing scenarios and teaches them to spot the red flags before they click.

Layer Your Technical Controls

No single tool stops phishing. You need layers:

  • Email filtering with advanced threat protection that detonates attachments in sandboxes
  • DMARC, DKIM, and SPF properly configured to prevent domain spoofing
  • Web filtering that blocks known phishing domains in real time
  • Endpoint detection and response (EDR) to catch payloads that slip through
  • Phishing-resistant MFA using FIDO2 or certificate-based authentication

A zero trust model ties all of this together by requiring continuous verification of every user, device, and session — not just at the front gate.

Build a Reporting Culture

Your employees need a one-click button to report suspicious emails. More importantly, they need to know they won't get punished for reporting — even if they already clicked. The faster your security team learns about a phishing attack, the faster you can contain it. Every minute counts when an attacker has valid credentials.

What Should You Do If You've Been Phished?

This is the question I get asked most. Here's the immediate playbook:

  • Change compromised credentials immediately — prioritize email and VPN accounts
  • Revoke active sessions — password changes alone won't kill session tokens an attacker already captured
  • Scan the affected endpoint — use EDR to check for persistence mechanisms
  • Alert your security team and begin incident response — document everything
  • Check for lateral movement — review authentication logs for unusual access patterns
  • Notify affected parties if any data was accessed or exfiltrated

Speed is everything. The NIST Cybersecurity Framework outlines a structured approach to incident response that every organization should have documented and rehearsed before an incident occurs.

The Human Firewall Is Your Best Investment

I've been in this industry long enough to watch organizations spend millions on security tools while ignoring the humans who click the links. Tools matter. Architecture matters. But the single highest-ROI investment you can make is turning your workforce into a human firewall that recognizes social engineering attempts before they succeed.

Our cybersecurity awareness training program covers phishing, ransomware, credential theft, physical security, and more — built for organizations that want measurable results, not just compliance checkboxes.

Every phishing attack that fails at the inbox is a data breach that never happens. Every employee who pauses, inspects, and reports instead of clicking is worth more than a six-figure security appliance. Train your people. Test your people. Then do it again.