Phishing

Definition

Phishing is a social-engineering attack that uses email, text messages, phone calls, or counterfeit websites to trick a person into revealing credentials, approving a payment, or running malware. Modern variants – spear phishing aimed at a named individual, adversary-in-the-middle kits that proxy a real login page and capture the authenticated session token, QR-code and voice phishing – target the person rather than the perimeter.

Why it matters to an MSP

Phishing is the most common initial access vector in SMB breaches and the on-ramp to BEC, ransomware, and account takeover. Client risk first: one clicked link in a tenant protected only by push-based MFA can yield a live Microsoft 365 session, hidden inbox rules, and a fraudulent wire request weeks later. Defense is therefore a layered product, not a spam filter – email security with link and attachment detonation, phishing-resistant MFA (FIDO2 keys or passkeys) for finance and admin roles, conditional access, and security awareness training with simulated campaigns. Insurers now ask about all four on the application. Your own risk second: your technicians hold admin access to every client tenant, which makes them the highest-value targets, and token-theft kits walk straight past push and SMS MFA. Hardware keys, device-bound sign-in, and short session lifetimes belong on MSP accounts before any client's. Operationally, a phishing compromise is a fixed runbook: revoke sessions, reset the password, remove inbox rules and OAuth consents, check forwarding, and review sign-in logs for the dwell period. Track simulation results per client – a report rate above roughly 50% and a click rate under 5% after a year of training are typical marks of a program that is working; numbers stuck above that are a conversation about the client's culture.

Related terms: BEC, MFA, Security Awareness Training, Ransomware