This article just came about about 3 days ago, talking about Microsoft getting breached, supposedly via a spear phishing campaign, compromising the email accounts and social media accounts of Microsoft employees.
Article:
http://securityaffairs.co/wordpress/21622/cyber-crime/spear-phishing-against-microsoft.htmlMy questions is regarding modern day phishing techniques. From my understanding, two/four years ago it was totally possible to do the standard:
1) copy web page
2) write credential grabbing php
3) upload to free web host
4) craft email
5) breach (capture credentials)
This sounds vague but I hope you guys get the point. The old ways of making phishing email is what im referring to, I think there is a post somewhere on here regarding what I was talking about.
But in 2013-2014, that isnt gonna fly obviously. Your more than likely to land a nice spot in the spam or junk box. My questions is what are some modern techniques in crafting these emails that are working these days?
Ive been reading that people would compromise a website/server, redirect victim to compromised server, and feed drive-by attacks to passerbys. And then there are stored xss (fairly rare now) breaches and CSRF attacks,etc. But without sounding to eager, but what are the BH tactics. As a penetration tester, I need to replicate and simulate a BH attack in ways. And phishing emails are crucial in attacks, but not dated attacks. My job currently audit website security. But I wanna expand to replicating APT attacks and leveraging user ignorance on my engagements. Just alot of the public info is dated....
