Phishing has evolved into something more sophisticated than the obvious Nigerian prince emails of the early 2000s. Modern attacks weaponise the very infrastructure designed to make our work easier: OAuth integrations, cloud storage services, and the subtle art of registering domains that differ by a single character from legitimate targets. Understanding how these attacks work is essential for anyone running or securing infrastructure.
The OAuth Trap: Permission Theatre
OAuth was meant to solve a problem. Rather than handing over passwords to third-party applications, users grant limited permissions to specific actions. In theory, this is safer. In practice, attackers have turned the OAuth flow into a convincing stage play.
An attacker crafts a fake application that requests access to a user's Google or Microsoft account. The login page looks legitimate. The permission prompt looks legitimate. The user approves access to their calendar, contacts, or cloud storage—actions that seem reasonable for a productivity tool. By the time the user realises something is wrong, the attacker already has authenticated access to years of emails, files, and contact lists. No password breach required.
The danger here is architectural. OAuth assumes the application requesting permissions is genuine. When an attacker controls that application, the system works exactly as designed—just not in the user's favour. The infrastructure itself becomes the attack surface.
Domain Lookalikes and Registration Gaps
A CEO receives an email from what appears to be their IT department. The sender address is nearly identical to the real one. The body references a recent security policy change. There's a link to update credentials. The URL looks correct at a glance, but registration patterns matter. A domain might differ by a single character—a transposed letter, a substituted numeral that resembles a letter, or registration in a similar TLD.
Domain registrars sell these lookalike addresses without restriction. The attacker doesn't need to compromise the legitimate domain; they simply buy a credible imitation and host a convincing copy of the login page. When a user enters their credentials, those credentials are recorded, and the attacker can then log into the real service using the stolen password.
What makes this effective is scale. Registering hundreds of domain variants costs money, but not much. Hosting a phishing page on commodity infrastructure costs almost nothing. The barrier to entry remains low, even as detection improves.
Dropbox, Google Drive, and the Shared-Link Problem
Cloud storage services offer a convenient feature: the ability to share files via links without requiring the recipient to create an account. Attackers exploit this convenience by sending messages containing links to malicious files or fake login pages hosted on legitimate cloud infrastructure. To the recipient, the URL appears to come from Dropbox or Google Drive—domains they trust.
The sender might claim to be a colleague, a manager, or a service provider. The shared link promises to contain an important document, a time-sensitive spreadsheet, or software that needs installation. Many organisations block external links or flag cloud-hosted content as suspicious, but the sheer volume of legitimate shared files makes filtering by domain name impractical.
The infrastructure of trust works against users here. Cloud storage providers want to make sharing effortless. Phishers use that effortlessness as cover.
Why Technical Awareness Matters for Operators
For hosting operators and infrastructure teams, the lesson is clear: your users are targets. If your organisation runs on-premises mail servers, web applications, or authentication systems, you're defending against attacks that increasingly bypass technical controls by exploiting human judgment.
Defence requires understanding the attacker's toolbox. Recent incident reports show that credential theft via phishing remains among the most common initial access vectors in breaches. This means your firewall rules, intrusion detection systems, and endpoint security tools may stop nothing if a legitimate user has already handed over their password to an attacker.
The infrastructure of trust—domains, cloud services, OAuth flows, shared links—cannot be made perfectly secure through technology alone. The best organisations combine technical controls (DMARC, SPF, MFA, conditional access policies) with education and incident response procedures that treat credential compromise as a working assumption rather than a theoretical risk.
Phishing persists because it's simple, scalable, and exploits a fundamental asymmetry: attackers need one success; defenders must prevent all attacks. Until that calculus changes, phishing will remain among the most reliable paths to an organisation's critical infrastructure.
