The Phishing Taxonomy

Not all phishing is equal. The classification matters because it determines investigation priority, containment urgency, and which user population is at risk.

Tier 1: Generic Phishing

Target: Anyone, no personalization. Lure: Package delivery, IRS notice, password expiration, security alert, prize notification. Volume: High — millions of identical or templated emails per campaign. Click rate: Low (< 2%) due to lack of personalization, but high volume means many victims.

Detection indicators:

Generic greeting (“Dear Valued Customer,” “Hi there”)
Sender domain registered within 30 days
Identical or near-identical emails to multiple employees
Link leads to credential-harvest page or malware download

SOC urgency: Medium — contain the email, search for other recipients.

Tier 2: Spear-Phishing

Target: Specific named individuals or roles. Lure: Personalized using victim’s name, role, manager name, current projects, org structure. Volume: Low — a few targeted emails per campaign. Research source: LinkedIn, company website, press releases, prior breaches.

Detection indicators:

Personal salutation with correct first name
References to real colleagues, managers, or projects (researched from OSINT)
Sent to a small number of specific targets (not mass distribution)
Link or attachment relevant to the victim’s role (invoice for finance, HR doc for HR)

Tier 3: Whaling

Target: Senior executives (CEO, CFO, CISO, board). Lure: Board-level themes: merger information, regulatory notice, investor inquiry, legal matter. Volume: Very low — may target a single individual. Research: Deep OSINT — press releases, SEC filings, conference speaking, LinkedIn activity.

SOC urgency: Critical — executive credentials have highest blast radius (wire authority, M&A access, security override capability).

Tier 4: Business Email Compromise (BEC)

Definition: Email fraud using social engineering (not necessarily malware) to manipulate wire transfers, tax forms (W-2/W-9), or credentials.

Three sub-types:

CEO fraud: Impersonate executive → pressure subordinate to wire funds urgently
Vendor fraud: Impersonate vendor → change payment account to attacker-controlled
Internal account compromise: Attacker takes over a real employee’s email → conducts BEC from the inside

Key BEC indicators:

Wire transfer, direct deposit change, or W-2 request
“Confidential — don’t discuss with others” — to prevent victim from verifying
Urgency + secrecy combination
New bank account not in ERP/accounting system
Reply-to differs from From:

Tier 5: AiTM (Adversary-in-the-Middle)

How it works:

Victim                    AiTM Proxy              Real IdP (Microsoft/Okta)
  │                           │                          │
  │── clicks phishing link ──►│                          │
  │                           │── forwards login page ──►│
  │◄── receives real login ───│◄── sends real login ─────│
  │── enters credentials ────►│── forwards creds ────────►│
  │                           │◄── sends MFA challenge ───│
  │◄── receives MFA push ─────│                          │
  │── approves MFA ──────────►│── forwards MFA ──────────►│
  │                           │◄── session token ─────────│
  │◄── forwards session ──────│ ATTACKER COPIES TOKEN     │

The attacker’s proxy captures the session cookie after MFA completes. They use this cookie to authenticate without the victim’s credentials or MFA device.

AiTM toolkits (known):

EvilProxy
NakedPages
Tycoon 2FA
Evilginx2

AiTM detection: Not in the email — in the identity logs. Look for:

Sign-in from new IP shortly after the phishing email was delivered
MailItemsAccessed from that new IP (attacker reading mail)
New-InboxRule created (attacker setting up forwarding)
OAuth consent grant to unfamiliar application

Tier 6: HTML Smuggling

What it is: Payload delivered inside HTML instead of as a file attachment. The email body or an HTML attachment contains Base64-encoded data that JavaScript assembles into an executable when the email is opened in a browser.

Why it bypasses filters: Email gateways scan attachments. An HTML file that contains encoded JavaScript — not an .exe, .docm, or .pdf — may pass through without triggering attachment scanners.

Detection in email: Content-Type: text/html attachment containing Base64 blob + JavaScript with document.createElement('a') and .click() — these are the payload delivery triggers.

Tier 7: Reply-Chain Hijacking

What it is: Injection of a malicious email into an existing legitimate email thread. The attacker has compromised a mailbox (or obtained thread content via OSINT/prior breach) and replies to an ongoing conversation with a malicious attachment or link.

Why it’s high-risk: The victim trusts the context (ongoing conversation with known colleague) and doesn’t apply the same scrutiny they would to a cold email.

Detection: The injected email’s headers won’t match the prior thread’s mail servers. The reply-to may be subtly different. The attachment wasn’t mentioned in prior thread content.