Reporter Impersonation Social-Engineering Test Tricked an Executive Into Forwarding a Phishing Link
Summary
A NetSPI assessment used a fake journalist and an Evilginx Microsoft login page to test executive responses. An executive forwarded the phishing link to two contractors; the testers stopped the session to avoid collecting out-of-scope credentials.
Key points
- Testers used public company information to impersonate a journalist and fabricate an urgent environmental-waste allegation.
- They created a lookalike domain and used Evilginx to mimic the client’s Microsoft login flow and capture credentials, MFA tokens, and session cookies.
- The initial emails asked executives to reply rather than including a link, aiming to build credibility and avoid automated filtering.
- An executive overseeing construction forwarded the phishing link to two contractors, extending the potential exposure beyond the assessment’s scope.
- The team escalated the out-of-scope activity and ended the phishing session without capturing the contractors’ credentials.
- The article recommends clear procedures for unsolicited media inquiries, verification through trusted channels, email protections, phishing simulations, and conditional access controls.
Article Details
- Topic
- A social engineering assessment that impersonated a journalist to target company executives and obtain access through a phishing landing page.