AttackFlow

1. 1Research
   Attackers scan public info (LinkedIn roles, email formats, suppliers, recent announcements) to craft convincing messages.
   Defend through reducing oversharing; train staff to spot social engineering clues.
2. 2First contact
   Attackers send phishing emails or messages using spoofed identities, urgency, or malicious links and attachments.
   Defend through enabling anti-phishing tools and teaching employees to check sender details and URLs.
3. 3Secondary contact
   Attackers reinforce the scam through phone calls to appear legitimate.
   Defend through verifying unexpected requests using known, trusted contact details, not the ones provided.
4. 4Redirect
   Attackers push victims to fake login pages, bogus payment portals or remote-access tools, or request MFA codes and passwords.
   Defend through using MFA, URL filtering and conditional access controls.
5. 5Extract/deploy
   Attackers steal credentials, bypass MFA, install malware, or trigger fraudulent transactions.
   Defend through monitoring for unusual logins and risky sign-in patterns.
6. 6Internal spread
   Attackers access internal files, escalate privileges, or send internal phishing from compromised accounts.
   Defend through applying least privilege, using anomaly detection and keeping strong incident response processes.
7. 7Final objective
   Attackers commit fraud, steal data, deploy ransomware, or exploit business email compromise.
   Defend through multi-layered security and ongoing staff awareness.