The Biggest Phishing Campaign Ever Documented
Between 2013 and 2015, a Lithuanian man named Evaldas Rimasauskas ran email scams against two of the largest technology companies in the world, Google and Facebook, and walked away with over 100 million dollars combined before anyone noticed. There was no malware, no zero-day exploit, no network breach in the technical sense at all. He registered a company with the same name as a real Asian hardware supplier both companies actually used, then sent invoices and payment requests from email addresses that looked like the real vendor's correspondence, complete with forged contracts and fake company stamps. Employees in the accounts payable departments paid the invoices, because everything about them looked exactly like the invoices they paid every month. That is phishing at its most expensive, and it worked on two of the most sophisticated companies on earth.
Nobody "hacks" the majority of stolen accounts and drained business accounts today. The owner or employee hands the money or the password over personally, convinced by something that looked exactly right. Phishing is social engineering, not hacking, and it remains the leading initial entry point in real breaches year after year because it targets the one component security teams can't patch: human attention under time pressure.
The Lure Types Actually Circulating Right Now
- Fake shipping and delivery notifications. "Your package couldn't be delivered, click here to reschedule" arrives constantly, timed to coincide with actual online shopping seasons when a real delivery notice is plausible for almost everyone. The link leads to a page harvesting your name, address, and payment details under the guise of a redelivery fee.
- Fake IT helpdesk password resets. Inside companies, an email or even a phone call claiming to be internal IT, warning that your password is expiring or your account is locked, directs you to a cloned single sign-on page. This single lure type has been behind several major corporate breaches, since a harvested corporate password often unlocks email, file storage, and internal tools all at once.
- Business email compromise (BEC) wire fraud. The Rimasauskas case above is the textbook example: impersonate a real vendor, executive, or business partner and request a wire transfer or invoice payment through channels that look completely legitimate. The FBI's Internet Crime Complaint Center has repeatedly ranked BEC as the costliest category of cybercrime by dollar losses, ahead of ransomware.
- QR code phishing, or "quishing". A malicious QR code on a parking meter sticker, a fake parking ticket left on a windshield, a poster, or embedded in a PDF attachment, leads straight to a credential harvesting page once scanned. QR codes are especially effective because most people have no habit of checking a URL before scanning, the way they might hover a link on a desktop screen.
The Tells That Actually Give It Away
Display name versus actual sender address. The name shown in your inbox says "PayPal Support" or "Microsoft Account Team", but tapping or hovering that name reveals the real address underneath, something like service@mail-pp-alerts.com or a string of random characters at a domain that has nothing to do with the company. Email clients trust whatever the sender puts in the display name field, no verification required, so this is pure impersonation with zero technical barrier.
Urgency and threat language. "Within 24 hours," "your account will be suspended," "unusual activity detected, verify immediately." Legitimate companies rarely threaten instant account deletion over email, and manufactured urgency exists for one reason: to shut down the part of your brain that would otherwise stop and check.
Mismatched link destinations. Hovering a link on desktop, or long-pressing on mobile, reveals where it actually goes before you click. If the domain isn't precisely the company's real domain, watch especially for lookalike tricks like an rn substituted for an m, or a capital I swapped for a lowercase l, it's hostile regardless of how convincing the visible text looks.
Generic greetings from companies that know your name. "Dear Customer" or "Dear User" from a bank that addresses you by name in every legitimate email is a mismatch worth noticing.
Suspiciously good writing, not just bad writing. The old advice of watching for typos and broken grammar has weakened considerably now that AI writing tools clean up phishing copy for free. Polished, professional prose is no longer proof of anything. The domain and sender address remain the tells that don't degrade over time.
The single habit that defeats nearly all phishing at once: never log in through a link that arrived in an email, text, or DM. Go to the site yourself, through a bookmark you saved or by typing the address you already know. An attacker cannot fake a URL you never clicked.
Smishing, Vishing, and Spear Phishing
Smishing is phishing delivered by text message, fake delivery notices, fake bank fraud alerts, all with a link. SMS has essentially no sender verification at all, so a text claiming to be from your bank's short code proves nothing about who actually sent it.
Vishing is voice phishing: a call claiming to be your bank's fraud department, talking you through reading out a one-time code you just received, supposedly to "verify your identity." No legitimate bank ever asks you to read a code back over the phone. Hang up and call the number printed on your card instead.
Spear phishing is personalized, researched attacks using your real name, employer, job title, and even the names of actual colleagues, often pulled straight from LinkedIn. It is dramatically more convincing than bulk spam precisely because it removes the generic tells listed above.
Real-Time Relay Kits Beat Codes, Not Just Passwords
The most dangerous modern variant uses tools like Evilginx, which sit between you and the real website in real time, proxying your traffic. You genuinely land on what feels like the real login page, type your real password, and even enter your real 2FA code, and the kit captures both instantly along with the resulting session cookie, then replays them against the real site before the code expires. This is the one category where SMS codes and standard authenticator app codes don't save you, because the kit simply forwards them.
The actual answer to relay phishing is phishing-resistant authentication: passkeys and hardware security keys perform a cryptographic handshake that checks the real domain automatically, so a proxy site sitting on a different domain gets no valid response no matter how convincing it looks to your eyes. Our FIDO2 explainer and passkey guide cover exactly how that handshake works.
If You Already Clicked One
- Typed a password? Change it immediately on the real site, and everywhere else you reused it. A unique password per site, generated with our password generator, turns a future repeat of this mistake into a minor annoyance instead of a multi-account disaster.
- Entered a 2FA code too? Assume the session itself is stolen. Change the password, then find "log out of all devices" or "sign out everywhere" in the account's security settings.
- Opened an attachment? Run a full antivirus scan and treat the device as untrusted until it comes back clean.
- Check recovery settings on the account. Attackers frequently add their own recovery email or phone number to maintain access even after you change the password.
Frequently Asked Questions
How can a fake login page look pixel-identical to the real one?
Cloning a webpage's HTML, CSS, and images takes seconds with basic tools freely available online. Visual appearance carries zero security information whatsoever. Only the domain shown in your browser's address bar matters, and even that requires a close look for lookalike substitutions.
Does the padlock icon and HTTPS mean a site is safe?
No. The padlock only confirms your connection is encrypted, not that the site's owner is honest. Free HTTPS certificates are available to anyone, phishing sites included, so an encrypted connection to a thief is still, in every meaningful sense, a connection to a thief.
Why did a phishing email slip past my spam filter?
Spam filters are trained on bulk, high-volume campaigns and catch most of those reliably. Freshly launched or highly targeted attacks, especially ones sent from a compromised legitimate mailbox that already has good sending reputation, slip through routinely. Filters are a net, not a wall, and your own judgment is the last line of defense.
Are password managers a form of phishing protection?
Surprisingly effective ones. A password manager autofills saved credentials only on the exact domain it originally saved them for. When autofill mysteriously refuses to trigger on what looks like a familiar login page, that refusal is often the first real sign you've landed on a lookalike domain.
What does it take to become genuinely unphishable?
Passkeys or hardware security keys on every account that supports them, unique passwords everywhere else, 2FA enabled across the board, and the strict habit of never logging in through a link that came to you. At that point there is no credential left for a fake page to extract that would actually work anywhere.
