The Phishing Email That Got Through: Lessons from Real Social Engineering

Technical controls fail. Email gateways filter the obvious phishing emails: messages with malformed headers, suspicious sender addresses, and known malware attachments. The emails that succeed are different. They are researched. They are targeted. They exploit organizational trust, impersonate credible senders, and reference information that makes them appear legitimate to someone inside the organization. This article examines a realistic social engineering attack and the lessons organizations should extract from it.

The Setup

A managed service provider had a customer that did not actively manage email security. The customer trusted the MSP to handle technical controls, and the MSP deployed standard email filtering that caught the obvious attacks. For more sophisticated attacks, the customer was vulnerable. The attacker understood this.

The attacker spent several weeks researching the customer organization. They accessed the customer’s public website, reviewed press releases, and examined LinkedIn profiles of employees. They identified the customer’s finance team, reviewed individual profiles to understand background and experience, and discovered that the finance director was new to the company, having joined six months prior.

The attacker identified the name of the customer’s primary vendor: a major software company that the customer contracted with for enterprise services. They then created an email address that closely resembled the vendor’s legitimate email domain, using a slightly misspelled version that would be difficult to notice during casual reading.

Targeted attacks succeed because they do their research. Generic phishing emails fail because they are generic. Successful attacks are personalized and reference real organizational information.

The Attack

The attacker sent an email to the finance director. The message was brief and professional. It stated that the software vendor was updating their billing system and required all customers to verify account information in a secure portal. The email included a link that appeared to direct to the vendor’s website but actually directed to an attacker-controlled domain designed to mimic the vendor’s login portal.

The message included several elements that made it appear legitimate:

The sender address closely resembled the legitimate vendor’s domain, differing only in one character.

The message referenced the software product that the customer actually used.

The message referenced an update to the billing system, something that occurs periodically with legitimate vendors.

The message used professional language and formatting consistent with the vendor’s communications.

The message included the customer’s actual account number, which the attacker had obtained from public sources.

The finance director received the message, glanced at the sender address, and did not notice the single character misspelling. The message appeared to come from the vendor they worked with regularly. The customer account number in the message matched the account number they used. The request to verify account information seemed routine.

The finance director clicked the link, arrived at the attacker’s phishing portal, and entered their vendor login credentials. The attacker now possessed valid credentials to the vendor’s system and could access the customer’s account information, modify billing details, or escalate access to the actual vendor’s systems.

Why Technical Controls Failed

Email security gateways use multiple detection mechanisms. They analyze sender reputation, examine message content for known malware signatures, and flag messages from domains that closely resemble legitimate domains. Despite these controls, the message passed through.

The attack succeeded because:

The sender domain was registered with a legitimate registrar and had no previous history of abuse. Reputation-based filters had no reason to suspect it.

The message content contained no known malware, no suspicious macros, and no malicious code. Content-based filtering found nothing to block.

The message did not originate from a known malicious IP address. The attacker used legitimate cloud infrastructure to send the message.

No attachment was included. Attachments are common vectors for malware delivery. Messages without attachments receive less scrutiny.

The typosquatting was subtle. The attacker did not use obviously suspicious domain names like “vend0r.com” or “vendor-secure.com.” They used a single character variation that humans often miss when reading quickly.

Technical controls are necessary but insufficient. They catch the obvious attacks. The attacks that succeed are those that pass through or around technical controls by being sufficiently subtle and sufficiently well-researched that they appear legitimate to a human recipient.

What Made the Attack Effective

The attack succeeded because it incorporated several elements that made it appear legitimate to the recipient. These elements are not difficult to identify with training, but they require active attention rather than passive reading.

Organizational Knowledge

The attacker knew the customer’s actual vendors, the actual account numbers, and the names of employees in finance. This information is publicly available on websites, LinkedIn, and other sources, but it requires effort to gather. The effort signals that the attacker was conducting a targeted attack rather than sending generic phishing emails to thousands of addresses.

Reasonable Request

The attacker did not request immediate wire transfer or emergency payment. Those requests trigger skepticism. The attacker requested account verification, something that legitimate vendors periodically require and something that seems routine to finance departments.

Sender Impersonation

The attacker impersonated a trusted entity: the customer’s legitimate software vendor. Email recipients are significantly more likely to click links in messages from familiar vendors than from strangers.

Subtle Typosquatting

The attacker changed only one character in the vendor domain. This is much more effective than obvious typosquatting. A recipient glancing at the message will likely miss the one-character difference, particularly on mobile devices where email clients display sender addresses in small fonts.

The Reality of User Awareness

Organizations frequently invest in security awareness training that claims to prevent phishing attacks. Most of this training is ineffective. The training is generic, annual, and does not reflect the reality of how employees process information during their actual work.

The finance director in this case had probably received security awareness training. They likely knew that phishing attacks occur and that they should be suspicious of unexpected links. However, in the context of their actual work, they received a message that appeared to come from a trusted vendor, referenced accurate information about the organization, and requested something routine. The conflict between generic training and specific context led to a mistake.

Effective security training for phishing is not generic lectures about identifying suspicious emails. It is role-specific, realistic, and practiced regularly. Finance teams should receive training with examples specific to their role: finance-related phishing attacks, common social engineering tactics, and realistic scenarios that might occur in their actual work.

More importantly, effective training should include simulations and feedback. Organizations should send simulated phishing emails to employees, track who clicks malicious links, and provide immediate feedback and training to those who fail. This creates behavioral change through repeated experience rather than through lectures.

Training that does not include simulation and feedback is largely ineffective. Employees learn through repeated practice and immediate feedback, not through annual lectures about general threats.

Detection and Response

Even with perfect training, some employees will click malicious links. Technical controls must assume that user training will fail and implement additional protections.

Implement multi-factor authentication on all sensitive accounts. MFA defeats credential theft even when attackers successfully trick users into entering credentials.

Monitor for unusual login activity. Logins from unfamiliar IP addresses, unusual login times, or logins followed immediately by account changes should trigger alerts and investigation.

Implement conditional access policies. Restrict access based on user, device, and location. A user logging in from a different country than usual should be treated with suspicion.

Log all authentication attempts and account access. Create audit trails that allow investigators to determine what accounts were accessed, what information was viewed, and what changes were made.

Implement rapid response procedures. When a credential compromise is suspected, disable the account immediately and begin forensic investigation.

In this particular incident, if the organization had implemented multi-factor authentication on the vendor account, the attacker would have been unable to access the account even with valid credentials. If the organization had monitored for unusual login activity, they would have detected the attacker’s attempt to access the account from an unfamiliar location. If the organization had logged all account access, they would have been able to determine what the attacker accessed.

Building Realistic Training

Organizations serious about reducing phishing risk should implement training that reflects realistic attack scenarios. The standard approach is insufficient.

Step One: Develop Role-Specific Scenarios

Finance teams face phishing attacks that reference account verification, wire transfer authorization, or payroll processing. IT teams face phishing attacks that reference system access, vendor contacts, or credential management. Develop training scenarios that reflect the actual threats each role faces.

Step Two: Reference Real Information

Effective simulations reference real vendors, real account numbers, and real organizational information. Obvious simulations (like “Click here if you are a human” links) teach very little because they do not reflect how real attacks operate.

Step Three: Deliver Immediate Feedback

When an employee clicks a malicious link in a simulation, immediately deliver feedback explaining the attack vector and the lesson. This creates behavioral change that annual training lectures do not achieve.

Step Four: Repeat and Measure

Conduct simulations monthly or quarterly. Track metrics: the percentage of employees who click malicious links, the time required for employees to report suspicious emails, the departments with the highest click rates. Use these metrics to target additional training to high-risk groups.

Conclusion: Phishing Will Continue

Phishing attacks will continue to evolve. Technical controls will continue to improve. However, the fundamental vulnerability will persist: humans make decisions based on incomplete information and contextual pressures. An employee in finance facing a message that appears to come from a legitimate vendor and requests something routine will sometimes click the link.

Organizations cannot prevent all phishing attacks through training. They must assume that some employees will be compromised and implement additional layers of protection: multi-factor authentication, monitoring, rapid response procedures, and forensic investigation. The combination of realistic training, behavioral feedback, and strong technical controls creates a defense-in-depth approach that reduces both the frequency of successful attacks and the impact when attacks do succeed.

The goal is not to prevent all phishing attacks. The goal is to reduce their frequency and limit the damage when they succeed.

Valukoda helps growing businesses make smarter technology decisions. Whether you need strategic IT leadership, managed services, or a security program built from the ground up, we bring decades of CIO and CISO experience to your team. Schedule a conversation or call us at 888.380.7212.