The popular image of phishing, clumsy grammar, obvious lures, suspect URLs, is twenty years out of date. Modern phishing in 2026 is operationally professional, technically capable, and surprisingly hard to spot even for security-aware users. Pulling apart a contemporary campaign reveals a supply chain almost as differentiated as the ransomware ecosystem it often feeds.
Stage 1: Lure design
The starting point is a pretext. The pretexts that work in 2026 are not the Nigerian prince; they are the boring HR notification, the vendor invoice, the shared OneDrive document, the DocuSign signature request, the Teams chat from a colleague. The Anti-Phishing Working Group’s quarterly trends report at apwg.org/trendsreports consistently shows that fewer than ten brands account for the bulk of credential-phishing impersonations: Microsoft, Google, DHL, USPS, banks, and major SaaS providers.
LLM-generated copy has eliminated the grammar tells. ChatGPT, Claude, and open-weight models produce native-quality English, French, German, Mandarin, and Polish phishing emails on demand. Researchers at Mandiant, IBM X-Force, and Sophos have all documented the shift to LLM-assisted lures across 2024 and 2025. The visible quality of phishing has gone up; the click-through rate has gone up with it.
Stage 2: Infrastructure
A modern phishing operation needs four things on the network side:
A domain that looks plausible. Typically a freshly registered lookalike (microsoftt-365.com, secure-docusign-portal.net) or, increasingly, a hijacked subdomain of a legitimate but neglected site. The MOVEit-era trend of dangling DNS records pointing to attacker-controlled cloud resources continues.
A TLS certificate. Free via Let’s Encrypt or other ACME providers. The padlock in the browser carries no useful security signal in 2026 and has not for a decade.
Hosting that survives takedowns long enough to harvest. Cloudflare Workers, Vercel, Netlify, Replit, and Pages-style hosting are heavily abused because they offer free, fast, ephemeral edge hosting. Kits also rotate through bulletproof hosters in jurisdictions that ignore takedown requests.
A delivery channel. Direct-to-MX is dead at scale because of Microsoft and Google’s spam filtering; modern campaigns abuse compromised mailboxes (sending from real, signed corporate accounts), legitimate marketing platforms (Mailchimp, SendGrid abuse), and increasingly LinkedIn, Teams, and SMS as side channels.
Stage 3: The phishing kit
Five years ago a phishing kit was a static HTML clone of a login page. In 2026 it is a fully featured adversary-in-the-middle proxy. The two dominant kits at the time of writing are Tycoon 2FA and Mamba 2FA, both sold as services on Telegram for low hundreds of dollars per month. Open-source ancestors include Evilginx, Modlishka, and Muraena.
What the modern kit does:
Renders the legitimate login page in real-time by proxying the actual Microsoft / Google / Okta service. The user sees a perfect copy because it is a perfect copy.
Captures the username, password, and second factor (TOTP code, push approval, SMS) as the user submits them.
Forwards everything to the real service. The user gets a successful login. The attacker captures the resulting session cookie.
Replays the cookie from attacker infrastructure, bypassing MFA entirely. From the application’s perspective, the session is a continuation of the legitimate login.
Modern kits also harvest device fingerprints, persist cookies through token refresh, and integrate with Telegram bots that ping the attacker the moment a high-value target authenticates.
This is what defeats SMS MFA, TOTP MFA, and push MFA. It does not defeat WebAuthn or passkeys, because the cryptography is bound to the legitimate origin and the AiTM proxy is, by definition, not at the legitimate origin.
Stage 4: Initial action
What happens after capture depends on the operator.
Credential commodity sale. The cheapest path: sell the captured username/password to an Initial Access Broker on a Russian-language forum. Going price for valid corporate credentials with active session: $200 to several thousand dollars depending on the company.
Targeted exfiltration. The credentials are used to read email, search SharePoint and OneDrive for sensitive documents, and exfiltrate them. Business email compromise (BEC) campaigns often stop here.
Pivot to ransomware. Increasingly the path: an Initial Access Broker sells the access to a ransomware affiliate who treats it as the foothold for a multi-week intrusion. Modern ransomware groups including Akira, BlackCat (when active), and RansomHub heavily source initial access from phishing-derived credentials.
Account takeover for fraud. Wire-transfer fraud, payroll redirection, vendor impersonation. The FBI’s IC3 reported $2.9 billion in BEC-related losses in their 2023 report, available at ic3.gov/Media/PDF/AnnualReport.
Stage 5: Persistence
A captured session is good for hours to days. Smart operators use it to establish durable access:
Add a federated identity provider or enterprise application that they control.
Register a new MFA method (their own authenticator) for the compromised account.
Create new mailbox forwarding rules that copy interesting threads to attacker mailboxes.
Add OAuth applications with broad scopes that survive password resets.
Microsoft’s documentation at learn.microsoft.com/en-us/defender-xdr/anomalous-token describes the detection patterns for this persistence layer; few organisations actively monitor for it.
What stops the campaign
In rough order of effectiveness:
Phishing-resistant MFA on every account. WebAuthn / passkeys break the AiTM proxy because the cryptography refuses to authenticate to the wrong origin. This is the single highest-leverage control.
Conditional access policies that require managed devices for sensitive applications. Even if credentials and a session cookie are captured, an attacker connecting from an unmanaged device fails the device-posture check.
Email authentication that actually rejects spoofs: SPF, DKIM, and DMARC at p=reject. The Internet Society’s MAAWG reports show that only a minority of corporate domains operate at p=reject as of 2025. The remainder are accepting spoof email.
User reporting culture. The "report phish" button in Outlook and Gmail is the cheapest detection signal in the building. Organisations that respond visibly to user reports, close the loop, thank the reporter, share findings, see an order-of-magnitude better signal-to-noise.
User training, by itself, is the lowest-leverage control on this list. It is necessary; it is not sufficient. The phishing supply chain has industrialised. The defensive response has to be architectural, not aspirational.