Phishing attacks are SCARY easy to do!! (let me show you!) // FREE Security+ // EP 2

Phishing attacks are alarmingly easy to execute because they don’t require breaking encryption or cracking software—they rely on tricking people into entering credentials or taking actions. The walkthrough demonstrates a full chain: build a fake LinkedIn login page to harvest usernames and passwords, then send a targeted “urgent” message to get a specific person to visit the trap.

The first phase focuses on credential harvesting. Using Kali Linux, the process clones a tool called black eye and runs a script to generate a phishing site that mimics LinkedIn. After the site is launched, the attacker waits for the target to interact. When the victim attempts to log in, the fake page captures sensitive inputs and also collects additional reconnaissance such as the victim’s public IP address, browser-related information, and—critically—login credentials saved to a local file. The attacker then uses the captured details to complete the next step: getting the victim to click the link in the first place.

That second phase turns the harvested trap into a deliverable. The attacker crafts a phishing email designed to look like it comes from LinkedIn messaging, using urgency and a plausible sender name to reduce suspicion. The message is sent to a single address for maximum targeting, described as spear phishing. The transcript goes further by framing the target as a high-value executive—“whaling”—and shows how the same basic phishing mechanics can be aimed at a CEO-level person rather than random users. Once the victim clicks the link and attempts to sign in, the attacker gains the credentials and additional information again.

Beyond link-based credential theft, the walkthrough highlights alternate delivery methods that exploit the same human weaknesses. It describes “smishing” (SMS phishing) and “vishing” (voice phishing), arguing that people often defend themselves against email threats more than they do against texts or phone calls. It also introduces “farming” phishing, where DNS or local host-file manipulation forces a victim’s device to route a legitimate-looking domain (like linkedin.com) to a malicious clone—even if the victim types the real address. In that scenario, the victim may feel safer because they’re not clicking a suspicious link; the redirection happens before the browser ever reaches the real site.

The closing section shifts to defense. The most emphasized protections are practical: rely on strong spam filtering, avoid clicking or downloading links from unexpected messages, and instead navigate directly to sensitive services by typing the address or using trusted bookmarks. When links must be used, the transcript stresses verifying the sender via email headers and confirming the message originates from a reputable source. It also recommends treating phishing as a multi-channel problem—email, text, instant messaging, and phone calls all carry risk—and educating family members, especially older relatives, to avoid clicking, answering, or sharing information.

Overall, the core takeaway is that phishing works because it targets decision-making under pressure—urgency, fear, and familiarity—while the technical setup can be assembled with off-the-shelf tools. That combination makes the threat accessible, scalable, and difficult to notice until credentials are already compromised.