Phishing: The attacker is not hacking your systems – they are hacking your employees

Fact: even the most expensive security stack can be bypassed with a well-written email.

We wish we could say that it is a poetic exaggeration, but unfortunately, it is not. This is a daily reality, and in many cases it still works remarkably well – while also being significantly cheaper than purchasing zero-day vulnerabilities on the dark web.

Hello, Barna here, Lead Developer and CISO at Whiteshield. Today, I would like to share one of the most interesting things I have learned over the past two decades of working as a senior pentester. Ready?

Most companies are not vulnerable only from a technological perspective: the real weakness lies in the human factor.

Attackers know this perfectly well. After all, why would they spend time breaching a well-configured infrastructure if sending a “mandatory password reset” email at 16:47 on a Friday afternoon – when everyone is already mentally halfway to the weekend – is enough? Why build sophisticated attack chains when simply pressing on people’s psychological pressure points often works just fine?

Why phishing still works

Phishing is one of the best-known forms of social engineering attacks. Its core principle is simple: the attacker persuades the user to voluntarily hand over something that would otherwise be technically difficult to obtain.

Whether it is a password, an MFA code, corporate access credentials or simply trust itself, the goal is to make the target surrender willingly – ideally without even realising afterwards that a mistake has been made.

At this point, you are probably imagining a poorly written “Nigerian prince” email full of grammatical errors. Unfortunately, phishing has not looked like that for a very long time.

Modern attackers write flawless messages, professionally replicate Microsoft 365 or Google login interfaces, use convincing corporate branding and signatures, and often gather so much OSINT from LinkedIn, social media platforms or breached databases that the email becomes disturbingly believable.

A well-executed phishing campaign today is no longer simple spam. It is a carefully engineered psychological operation – and one where technology alone is often not enough.

Social engineering is about manipulation

Social engineering works so effectively because it does not target technological flaws. It does not necessarily search for buffer overflows, browse CVE lists, or attempt to brute-force firewalls.

Instead, it targets the mechanisms that drive human behaviour: curiosity, urgency, helpfulness, authority bias and emotional pressure. The attacker creates a situation where the victim feels compelled to act immediately. Under pressure, fear increases while critical thinking temporarily decreases – and that is when mistakes happen.

The most uncomfortable part? Incidents still occur even when the technical protections are fundamentally sound, the email gateway is properly configured, endpoint protection is functioning correctly, and MFA is enabled.

In fact, modern adversary-in-the-middle phishing techniques can steal session tokens even in MFA-protected environments, meaning that multi-factor authentication alone is not always sufficient against a well-executed attack.

As company leaders, this is the most important thing to understand: attackers do not need to fool everyone. They only need one stressed employee during a hectic Monday morning or month-end financial closing. One overwhelmed HR colleague responding to dozens of Teams messages every hour is enough.

Modern phishing and social engineering attacks do not rely on technical perfection. They rely on human vulnerability – and they exploit it remarkably well.

What does a pentester actually do during a phishing simulation?

Outsiders often assume phishing simulations are simply about sending fake emails and waiting to see who clicks. The reality is far more complex – and honestly, much more unsettling.

As pentesters, we do not randomly blast templates at hundreds of employees, hoping somebody makes a mistake. At Whiteshield, every phishing simulation is built on deliberate scenario design, behavioural analysis and narratives tailored to the company’s operational culture.

Classic “Nigerian prince” emails have largely become internet folklore at this point. Although they still occasionally work, which is both fascinating and mildly depressing as a social experiment about humanity.

1. Scenario design: credibility matters more than technology

Every good phishing attack starts with a believable story. As pentesters, the first thing we identify is the scenario that would feel completely natural within the target organisation’s culture.

It may be an unexpected HR announcement, an attractive cafeteria policy update, a mandatory IT security training session or an urgent out-of-schedule meeting invitation. The power of social engineering lies precisely in the fact that it does not try to appear extraordinary – it tries to appear routine.

Corporate environments are often chaotic and layered enough that a pressure-inducing, urgent-looking email filled with expectations does not feel suspicious at all. That is exactly why people respond to it.

2. Infrastructure replication: pixel-perfect deception

Next comes the technical side: replicating the target interface itself.

Whether it is a Microsoft 365 login page, a VPN portal, a CRM platform or a corporate SSO interface, the objective is to create something virtually indistinguishable from the legitimate version.

And if that succeeds, the risk of credential compromise becomes enormous. Ordinary users do not analyse TLS certificates and domain names at half past eight in the morning before their first coffee. They click, log in and continue with their day. Exactly as they always do.

Modern phishing attacks are designed around this routine behaviour. They exploit the fact that people make decisions based on familiar visual patterns rather than performing security audits on every login screen they encounter.

3. The phishing email: this is where everything is decided

Modern phishing emails are dangerous precisely because they do not resemble what most people imagine a cyberattack looks like. They do not threaten users, write in ALL CAPS or aggressively demand immediate action.

Instead, they appear professional, calm and credible – applying just enough urgency to trigger action without raising suspicion. In many ways, they look exactly like an ordinary corporate email on a Monday morning.

As pentesters, we are not only interested in who “falls for” the attack. During phishing campaigns, the behavioural patterns are often far more valuable:

• Who opened the email?
• Who clicked?
• How much trust did the content generate?

This analysis allows us to identify where the organisation’s security posture begins to crack – and how it can be strengthened.

A professional phishing assessment typically measures and reports:

• Open Rate – the curiosity factor
  How many employees opened the phishing email? This reveals how effective the subject line and psychological triggers were.
• Click Rate – the trust factor
  How many recipients clicked the embedded link? This is not merely a technical issue, but also a question of trust and behavioural conditioning.
• Login/Input Rate – the critical incident
  How many users actually entered their credentials during the simulation? The numbers are often sobering. It is not unusual for 20–30% of employees to click, while up to 10% voluntarily submit login credentials.

Pro tip: if the admin account falls for the phishing simulation, they usually end up paying for the team drinks that evening.

Security awareness is a business necessity

One of the most important aspects of phishing defence is not technological, but cultural.

This is why it becomes dangerous when companies treat phishing simulations as an internal “gotcha game” meant to expose careless employees. That is not security awareness – it is fear-based management. And over time, it damages organisational culture just as much as poorly handled incidents do.

Real security awareness is about education, behavioural reflexes and developing healthy scepticism. Employees need to learn to recognise the psychological patterns that modern phishing and social engineering attacks rely on.

Today, good firewalls and endpoint protection alone are no longer enough. Human decision-making has become just as much a part of the defensive infrastructure as any security appliance sitting in a rack cabinet.

Corporate security today is shaped not only by technology, but by people, behaviour and individual decisions.

And genuine security awareness cannot be reduced to an annual PDF document with a “click here to confirm you have read this” button. It requires continuous practice, feedback and education.

If you are curious how your own organisation would respond to a well-crafted phishing attack, it is worth testing before a real attacker does it for you. Contact us!