Follow the Access · 04 — The Phish: Deceiving the Human the Firewall Cannot Protect

Follow the Access — Case 04. This register follows the intruder from the login prompt to the foothold's fate, and closes each case on what the access becomes: RANSOMED · MINED · PROXIED · HARVESTED · WIPED · RESOLD.

CISA named two front doors to the ransomware disaster. Case 03 was the first — the exposed RDP endpoint, a machine left facing the street. This case is the second, and it is different in kind, because it does not attack a machine at all. It attacks a person. Phishing is the deception of a human being into doing the attacker's work for him: reading a message, believing it, and typing a password into a page that is not what it claims to be. Every technical control an organization builds — the firewalls, the patched servers, the hardened logins — sits behind the one component none of them defends, the human who opens the email. Phishing is the vector that walks straight past all of it by knocking on that door instead.

There is a fact about this case that the register has to state plainly, because it is unlike every case before it: the honeypot beneath these words cannot see this attack. Every prior case was read directly off the sensor — the credentials tried, the tools fingerprinted, the miners downloaded, all captured because the attack came over the network to a machine the honeypot was watching. A phish comes to none of those. It arrives in an inbox and is opened in a mind. The decisive moment — the instant the victim decides to trust the lure — happens nowhere the sensor can reach, on no wire it can tap. The register's own instrument is blind to phishing, and that blindness is not a gap in the coverage. It is the whole point of the vector. Phishing works precisely because it routes around the technology by routing through the person, and the honeypot's silence is the loudest possible evidence of why it succeeds.

So the disposition here is HARVESTED — because what the phish takes is not compute and not, at first, a ransom, but an identity. The victim hands over a working credential, and increasingly a live session, and the attacker walks away holding a portable copy of who the victim is. That harvested identity is the product, and it flows onward into every other case in this register. This is the case about deceiving the human the firewall cannot protect, and about how trust, once harvested, becomes access.

1. The Attack on Judgment, Not Code

Begin with what makes phishing categorically different from every other vector in this register, because the difference determines everything about how it must be understood and defended. Cases 01 through 03 attacked machines: a default password, a guessed one, an exposed service. Each had a technical flaw at its root — a credential not changed, a login not hardened, a port not closed — and each therefore had, at least in principle, a technical fix. Phishing has no technical flaw at its root. Nothing is unpatched. The email server works correctly, the login page it imitates is genuine, the network is sound. The flaw it exploits is in judgment: the human tendency to trust a message that looks legitimate, to act on urgency, to click before scrutinizing. You cannot patch that, because it is not a bug. It is how people work.

This is why phishing is not a trick but a discipline, catalogued in the MITRE ATT&CK framework as T1566 with its own taxonomy of sub-techniques — malicious attachments, malicious links, deception via trusted services. A real phishing operation has stages that mirror a legitimate marketing campaign: reconnaissance to learn the target, pretext design to craft a believable story, infrastructure to host the lure and receive the loot, and payload to capture what the victim surrenders. The mass phish casts a wide net with a generic story — a package delivery, a password expiry, an invoice — and profits from volume, because even a low click rate against millions of recipients yields thousands of victims. The whole enterprise is built not to defeat a computer but to persuade a person, and persuasion, unlike exploitation, scales to anyone with an inbox regardless of how well their machines are secured.

The consequence is a defensive inversion. Against the earlier vectors, a competent administrator could close the hole and be genuinely safe. Against phishing, there is no hole to close — there is only a population of people, every one of whom is a potential entry point, every one of whom will eventually encounter a message crafted well enough to fool them. The best-defended network in the world still delivers email to humans, and humans can be deceived. That is the permanent condition phishing exploits, and it is why the vector has sat at the top of the list for as long as the list has existed.

2. Harvesting the Credential

Now the mechanism of the most common form, credential harvesting, because it shows exactly how deception becomes access. The lure carries a link, and the link leads to a login page. The page is a forgery — a pixel-perfect copy of a Microsoft 365 sign-in, a bank portal, a corporate webmail, a VPN gateway — hosted somewhere the attacker controls. The victim, believing they are logging in to the real service, types their username and password. The page captures both and, to complete the illusion, often forwards the victim to the genuine site so that the login "succeeds" and nothing seems wrong. The victim goes about their day. The attacker now has their password.

The infrastructure behind these pages has professionalized to survive defense. Talos and other researchers have documented credential-harvesting pages hosted on abuse-resistant systems such as IPFS — the distributed file network — precisely because content there is far harder to take down than a page on ordinary hosting. Phishing kits are sold as products, complete with convincing templates for dozens of major brands, so that an operator needs no design skill to stand up a flawless fake. The whole apparatus exists to solve one problem: make the counterfeit page indistinguishable, for the few seconds it takes to type a password, from the real one. And it does not have to be perfect for long. It has to be perfect for the moment of the login, and then its job is done, because by then the credential is captured.

What makes credential harvesting so potent is that it defeats the defenses of the earlier cases without touching them. A strong, unique, un-guessable password — the exact fix that beats the brute force of Case 02 — offers no protection here, because the victim types it in willingly. Key-based authentication, lockout policies, source restrictions: none of them engage, because from the system's point of view the login is legitimate. The victim's own hand delivered the credential to the attacker. This is the unique danger of phishing: it does not break your locks, it convinces you to hand over your keys, and a key freely given opens a door as well as a key that was stolen.

3. The Targeted Phish and the Loss of MFA's Protection

Move up the spectrum, because phishing runs from the generic to the surgical, and both ends matter. At the surgical end is spear-phishing: not a wide net but a single, carefully aimed message against a specific, researched individual. Here the attacker knows the victim's name, their role, their manager, their current projects, the vendors they work with — assembled from the company website, social media, and prior breaches — and builds a message the victim is primed to trust because it fits their world exactly. Kaspersky's DarkHotel investigation documented an actor spear-phishing specific executives with spoofed installers and zero-day-laden documents; CrowdStrike documents state-nexus adversaries running patient credential-phishing campaigns to collect the accounts they want. At this end, phishing stops being a numbers game and becomes an intelligence operation, and its success rate against a well-chosen, well-researched target is frighteningly high, because the message is not merely plausible — it is exactly what the victim was expecting to receive.

And then there is the evolution that answers the obvious defense. For years the advice was: enable multi-factor authentication, and a phished password becomes useless, because the attacker still lacks the second factor. So phishing evolved past it. Modern adversary-in-the-middle phishing kits do not just capture the password — they sit in the middle of the login in real time. The victim enters their password and their MFA code into what looks like the real site; the kit relays both to the genuine service as the victim types them; the service, satisfied, issues an authenticated session; and the kit steals that session cookie. The attacker now holds a token that is already past MFA — a live, logged-in session — and can act as the victim without ever needing the password or the code again. The second factor was satisfied in real time and then rendered irrelevant, because what was stolen was not the credential but the session it produced.

This is why the disposition of a modern phish is best described as HARVESTED in the fullest sense: the attacker harvests not a static secret but the victim's live authenticated identity. It is the difference between stealing a copy of someone's key and stepping into their body while they are mid-stride through the door. Ordinary MFA — the one-time code, the push notification — was supposed to be the answer to phishing, and against the simplest credential harvesting it still helps. But against the adversary-in-the-middle kit it is bypassed, because the kit does not need to defeat the second factor; it lets the victim provide it and then takes what the second factor unlocked. The arms race moved, and the harvested session is where it moved to.

4. HARVESTED — Where the Stolen Identity Goes

Now the disposition proper, because HARVESTED names not just what is taken but what happens next, and the next step connects this case to the whole register. The phish's output is an identity — a working credential or a live session that lets the attacker be the victim. That identity is not the end of anything; it is the beginning. What the attacker does with it depends on who the victim is and who the attacker is, and it flows down every path this register documents.

If the harvested identity belongs to a finance employee, the attacker may use it directly for business email compromise — sending, from the victim's own real account, a convincing instruction to wire money or change payment details, a fraud that costs organizations billions annually precisely because the request comes from a genuine, trusted internal mailbox. If the identity is a foothold into a corporate network, it may be handed or sold to a ransomware affiliate, who uses it exactly as the affiliate of Case 03 used the RDP login — as the interactive entry point for the escalate-exfiltrate-encrypt campaign. If the attacker is a harvester rather than an operator, the credential joins the inventory of the access-broker market of Case 02, priced and sold to whoever wants it. And if the victim is a target of espionage, the harvested session becomes a quiet window into their mail and files, read for as long as the access survives. Phishing is a harvesting engine at the top of the criminal chain, converting human trust into portable identity and feeding that identity into mining, ransoming, fraud, resale, and espionage alike.

This is why HARVESTED is the honest disposition rather than any single downstream fate. To pin phishing to RANSOMED would understate it, because vast amounts of phishing never touch ransomware — they feed fraud, or theft, or resale. What is invariant across all of it is the harvest itself: the moment the victim's trust becomes the attacker's credential. That is the disposition this case owns, and the register marks it precisely because it is the hinge. Almost every other vector in this collection can be reached, one way or another, through a successful phish — which is exactly why phishing sits beside RDP at the top of the list, and why it is the vector that a defender, having hardened every machine, still cannot fully close.

5. Why There Is No Clean Fix

The register owes the defense, and honesty here requires admitting up front what the earlier cases could not say: phishing has no clean, single fix, because it exploits judgment rather than a flaw, and judgment cannot be patched. What it has instead is a layered defense, where each layer reduces the risk and none of them closes it, and where the honest goal is not prevention but resilience.

The layers stack from the network inward. Email authentication — SPF, DKIM, DMARC — makes it harder for an attacker to spoof a trusted sender's domain, cutting off one class of impersonation. Filtering and link analysis catch a share of lures before they reach the inbox. User awareness training raises the odds that a given employee recognizes a lure and reports it rather than clicking — genuinely valuable, and genuinely limited, because training reduces click-through but never eliminates it; against a large enough population and a good enough lure, someone always clicks. Least-privilege access and monitoring limit the blast radius when a harvest succeeds, so that one compromised identity does not become the whole network. And above all — because it is the one control that addresses the modern session-theft phish — phishing-resistant multi-factor authentication: hardware security keys implementing FIDO2/WebAuthn, which are cryptographically bound to the real site and therefore cannot be relayed by an adversary-in-the-middle kit. Unlike a one-time code, a FIDO2 key simply will not authenticate to the counterfeit page, because the page is not the real origin, so the harvest fails even if the victim is fully deceived.

That last control is the closest thing this case has to the clean fixes of the earlier ones, and it is worth stating why. Awareness training fights the attack on the attacker's chosen ground — human judgment — where the attacker will always eventually win against someone. Phishing-resistant MFA changes the ground: it accepts that the human will sometimes be deceived and makes the deception insufficient, because the second factor cannot be phished. The harvested password becomes worthless; the counterfeit page cannot complete the login; the whole vector's payoff collapses. It does not stop the lure from being sent or clicked, but it stops the click from mattering. The honest summary of the defense is therefore this: you cannot stop your people from being deceived, so build the system to survive their deception — and the single highest-leverage way to do that is to make the credential the phish harvests too weak, by itself, to be worth harvesting.

6. The counter-narrative, steelmanned

The strongest objection to this case is that phishing is not really an access vector at all but a category so broad it explains nothing, and that folding it into a register of specific technical vectors is a categorization error.

The argument runs like this. Every other case in this register names a concrete technical thing — a default password, an exposed port, a specific protocol — that can be found, measured, and fixed. Phishing names none of that; it names a human failure that sits behind all vectors and none, an infinitely elastic category that stretches from a teenager's fake login page to a nation-state's zero-day-laden spear-phish. To call it "a vector" is to blur the useful distinctions the register exists to draw, and worse, the objection continues, its lesson dissolves into truisms — "don't click suspicious links," "enable MFA," "train your users" — advice so universal, so endlessly repeated, and so obviously insufficient (since phishing thrives despite decades of it) that repeating it in a dossier is an admission of defeat rather than a contribution. On this view phishing belongs in a report on human factors, not a technical register of access.

The register accepts the taxonomy point and turns the defeatism around. Yes, phishing is broader than the machine-specific vectors, and yes, its outcomes are diffuse — that breadth is exactly why HARVESTED, not any single downstream fate, is the honest disposition, and why the case is framed around the harvest itself rather than pretending to a clean fix. But breadth is not vagueness. Phishing has a precise, invariant core — the counterfeit that captures a credential or session — and a precise, measurable evolution, from static-password theft to real-time session harvesting, that this case documents concretely. The "truism" objection mistakes the failure of the wrong advice for the absence of right advice: "train your users" is indeed near-useless as a primary defense, and the case says so plainly; the contribution is the specific, non-obvious point that the durable control is not training but phishing-resistant FIDO2 MFA that makes the human's inevitable mistake survivable. And the register earns the case honestly by admitting what it cannot do: its own sensor is blind here, and it says so, rather than pretending the honeypot covers a vector it does not. A register of access that omitted the single most human vector — one of the two doors its highest authority names — because that vector is uncomfortable to measure would be describing the internet's locks while ignoring the fact that most break-ins come through a person holding the door open.

7. Disposition — HARVESTED

Case 04 followed the phish — the deception of a human being into surrendering their own credentials — the second of CISA's two dominant ransomware doors, and the one that attacks not a machine but a person. It exploits judgment, not code, which is why it has no clean technical fix and why the register's own honeypot is blind to it: the decisive moment happens in a mind, not on a wire, and that blindness is the sharpest evidence of why the vector works. From mass credential-harvesting pages to surgical spear-phishing to adversary-in-the-middle kits that steal the live session past MFA, the whole apparatus exists to make a counterfeit trustworthy for the few seconds it takes to capture an identity.

The disposition — the foothold's fate — is HARVESTED. The phish's product is a working credential or a live session token, a portable copy of the victim's identity, and it flows onward into every other case in the register: business-email-compromise fraud from the victim's own mailbox, a foothold handed to a ransomware affiliate, a credential filed into the access-broker market, a quiet window for espionage. Phishing is the harvesting engine at the top of the criminal chain, converting human trust into portable identity — and the harvest, not any single downstream use, is the disposition this case owns.

The defense cannot be clean because the target is human, but it can be resilient. Filtering, DMARC, training, and least privilege each help and none suffices, because against a large enough population some well-crafted lure always succeeds. The one control that changes the ground is phishing-resistant MFA — a FIDO2 hardware key that cannot authenticate to the counterfeit page — because it accepts that the human will be deceived and makes the deception insufficient. The honeypot beneath these words did not see this attack, and never will, because it did not come over the wire; it came to a person, in an inbox, wearing the face of something they trusted. The vectors do not lie, but this vector does not come to the sensor at all — it comes to you. The lure was believed, the password was typed, the identity was harvested, and the attacker walked away wearing it. We do not judge. We record. We let people judge — and then, if they are wise, make the harvested password too weak to matter.

Follow the Access continues. Case 04 disposition: HARVESTED. Confidence: HIGH — phishing's status as a primary vector is CISA's finding; the technique is formalized in MITRE ATT&CK T1566; credential-harvesting infrastructure (including IPFS-hosted pages) is documented by Cisco Talos; targeted spear-phishing by Kaspersky (DarkHotel) and CrowdStrike; adversary-in-the-middle session theft is a documented, named evolution (related to MITRE T1557); and phishing-resistant FIDO2/WebAuthn MFA is established in NIST SP 800-63B and CISA guidance. The register openly notes that its own honeypot cannot observe this vector — a scope fact stated as such, not a data claim. The downstream fates connect to Cases 02 (broker), 03 (ransomware), and later fraud/espionage cases. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the lure, the trust, and the identity carried off in the dark.