--- title: "Social Engineering & Phishing · VORNAC Research" description: "Pretext design, channel selection, and the patterns specific to phishing privileged users — including the failure modes that turn a campaign into an internal incident on your side." url: https://www.vornac.com/en/research/offensive-tradecraft/social-engineering-phishing lang: en published: 2026-06-02 updated: 2026-06-02 alternate_de: https://www.vornac.com/research/offensive-tradecraft/social-engineering-phishing --- [Research Index](https://www.vornac.com/en/research) / [1 · Offensive Tradecraft](https://www.vornac.com/en/research/offensive-tradecraft) / Social Engineering & Phishing Background · [1 Offensive Tradecraft](https://www.vornac.com/en/research/offensive-tradecraft) # Social Engineering & Phishing. Pretext design, channel selection, and the patterns specific to phishing privileged users — including the failure modes that turn a campaign into an internal incident on your side. ## Pretext-design — what works - **Aligned with real work.** Reference an actual ticketing system, an actual vendor, an actual quarterly process. OSINT first, write second. - **Plausible CTA.** "Confirm your timesheet by Friday" beats "Verify your password now." The action requested is something the target would expect to do anyway. - **No escalation pressure.** "Urgent — locked account in 1 hour" trips the training reflex. Legitimate IT rarely uses countdown threats. - **Look like the system, not like an attacker.** Office 365 legitimate notification → copy the HTML structure, headers, footer, unsubscribe link. Diff vs. a real one until they're indistinguishable. - **Right sender.** Spoofed display name + neighboring-domain typosquat. Targets read the display name; only ~5% check the actual From: header. ## Channel tradeoffs - **Email.** Highest volume, lowest conversion. Defended by mail gateways, sandbox detonation, URL rewriting. Plan for 5–15% click rate on first send. - **SMS (smishing).** Lower volume capacity, higher conversion. Sandbox doesn't exist for SMS the way it does for email. Plan for 20–35% click rate when pretext is sharp. - **Voice (vishing).** Highest conversion against helpdesk staff. Hardest to script. Most effective on Monday mornings when ticket volume is highest. - **In-person / physical.** Tailgating, dropped-USB. Highest legal/scope risk. Always written-authorized with on-call white cell contact. - **Supplier impersonation.** Email from a known vendor with a known payment-detail change request. Very high conversion against finance teams; high legal scrutiny. ## Targeting admins specifically - **Tooling-trust.** Admins click links from tools they use daily — Jira, Confluence, PagerDuty, GitHub. Pretext that looks like a notification from one of those. - **Helpdesk pretext.** Reverse the direction. You call as a user with an authentic-looking ticket reference; ask helpdesk to push an MFA, claim "phone broke", get a temporary code. - **Console-link redirect.** URL that lands on a real admin console first, then redirects to your harvester. Browser security indicators show "secure" because the first hop was real. - **OAuth consent phishing.** Don't phish password; phish an OAuth scope grant. The target sees a real Microsoft consent page and clicks Allow. ## Operational guardrails (don't burn the engagement) - **Written scope, named targets only.** No improvising new recipients mid-campaign. - **Credentials handled by one operator.** Captured creds never sit in a shared inbox or chat. Hash them at capture, store the hash, decrypt only at use. - **Sender infra cleanly attributable on request.** Don't reuse domains across clients. Don't reuse the SAME domain you used for actual blue-team work last quarter. - **Kill switch.** Single command that takes down all landing pages, revokes captured tokens, and notifies white cell. Test it before campaign launch. **Rule of thumb**The cleanest phishing campaign is the one the blue team learns the most from. Maximize that, not raw click rate. A 40% click rate with no detection-loop feedback teaches nothing; a 12% click rate that the SOC catches in 11 minutes is a successful exercise. Domain [1 · Offensive Tradecraft](https://www.vornac.com/en/research/offensive-tradecraft) Tier Background Engagement phases Authentication Published 2 June 2026 Looking up an acronym? [Open the Glossary](https://www.vornac.com/en/glossary) ## Related notes in this domain - [Featured Comprehensive Pentest Reference](https://www.vornac.com/en/research/offensive-tradecraft/comprehensive-pentest-reference) - [Featured Pentest Methodology — Canonical Reference](https://www.vornac.com/en/research/offensive-tradecraft/pentest-methodology-canon) - [Featured Advanced Penetration Testing & Red Team](https://www.vornac.com/en/research/offensive-tradecraft/advanced-pentest-and-redteam) - [Featured Recon & Discovery](https://www.vornac.com/en/research/offensive-tradecraft/recon-and-discovery) - [Featured Web Server — Attack & Defense](https://www.vornac.com/en/research/offensive-tradecraft/web-server-attack-defense) - [Featured Active Directory Pentest](https://www.vornac.com/en/research/offensive-tradecraft/active-directory-pentest) - [Featured Internal Pivoting & Lateral Movement](https://www.vornac.com/en/research/offensive-tradecraft/internal-pivoting) - [Reference Recon Tooling — Operator Reference](https://www.vornac.com/en/research/offensive-tradecraft/recon-tooling) - [Reference Operator Toolkits — Catalog & Reference](https://www.vornac.com/en/research/offensive-tradecraft/operator-toolkits) - [Reference Automation vs. Manual Testing](https://www.vornac.com/en/research/offensive-tradecraft/automation-vs-manual) - [Background Pentester Foundations & CTF Practice](https://www.vornac.com/en/research/offensive-tradecraft/pentester-foundations) [Previous note Automation vs. Manual Testing](https://www.vornac.com/en/research/offensive-tradecraft/automation-vs-manual) [Back to domain](https://www.vornac.com/en/research/offensive-tradecraft) [Next note Pentester Foundations & CTF Practice](https://www.vornac.com/en/research/offensive-tradecraft/pentester-foundations) From reference to evidence ## Run this against your own environment.