Account Compromise

The final stage of the phishing attack occurs once the attacker successfully gains access to the victim’s account.

With valid credentials and an authenticated session, the attacker can access the account as the legitimate user. This often leads to follow-on activity such as abusing trusted relationships, accessing sensitive data, and using the compromised account to launch additional phishing attacks.

At this point, the phishing campaign transitions from credential theft to post-exploitation, where the attacker leverages the compromised account to expand their access or impact.

See below for common post-exploitation activities