Red Team Corner: Phishing

Red Team Corner: Crafting Phishing Payloads that Actually Get Clicked

Phishing remains one of the most reliable ways to breach a network. For red teamers, building a phishing campaign is not just about throwing together a fake login page or sending a sketchy email. The real skill is understanding what makes people act and using that knowledge to your advantage.

Here’s a closer look at the techniques and psychology behind payloads that actually work.

What makes a phishing lure effective?

Phishing is social engineering at its core. The goal is to convince a person—not just bypass a system. A strong payload needs both technical quality and psychological pull.

Key factors:

• Relevance
  The lure has to fit the environment. Sending a fake Teams invite to a Slack-based company fails immediately.

• Urgency
  Phrases like “your account will close soon” or “action required today” push people to react fast, often without full attention. You have to be careful with this though, as it can actually set off alarm bells because of training.

• Authority
  Messages that appear to come from IT, management, or trusted brands carry more weight and lower suspicion.

• Curiosity or reward
  Things like “package delivery” or “bonus available” work because people naturally want to follow up.

• Polish
  Errors in grammar, design, or links kill trust. Clean, professional visuals and wording keep users comfortable enough to act.

Technical tactics that work

The psychological side is half the battle. You also need your payload to function well technically.

• Cloning real sites
  Tools like Evilginx or Modlishka make it easy to recreate real login portals with high accuracy.

• Filter evasion
  Use random subject lines, trusted sender domains, and services like Google Docs or Dropbox to slip past security checks.

• Optimize for mobile
  Most people check email on phones where URLs are cut off and fine details are harder to spot.

• Obfuscation
  Shortened URLs, redirect chains, and QR codes make it harder for the target to see the true destination upfront.

Why people click: understanding the mindset

People fall for phishing not because they are careless but because the attack targets basic patterns of thinking.

Some drivers:

• Distraction and overload
  When people are rushed or multitasking, their ability to spot red flags drops.

• Familiarity
  A message that feels routine or expected gets less scrutiny.

• Fear of consequences
  Warnings about locked accounts or lost access prompt quick reactions out of concern.

• Validation
  If something looks like it fits into the target’s normal workflow, they are less likely to doubt it.

TL;DR:

A solid phishing payload combines sharp technical execution with a deep understanding of human behavior. The best campaigns feel ordinary, not flashy. Your goal is to design something that blends in, gets noticed for the right reasons, and pushes action before the target thinks too hard about it.

A post by the Western Research Advisory for Vulnerabilities, Exploits, & Networks.