I Spy a Spy Degrading Adv Phishing Campaigns Against Your Org and Clients

The talk starts with a baseline of phishing, from classic username-and-password theft to adversary-in-the-middle proxy kits that capture session tokens and get past MFA. The speaker argues that training users alone is not enough. Instead, the approach is external deception: plant honey credentials on your own services and watch what an attacker does after using them on a phishing site.

The method has four phases. Requirements means logging authentication to external applications and creating honey accounts with MFA enabled. Detection logic and a response plan come next, followed by setup on a clean, dedicated system with thorough capture and careful notes on which fake credentials went to which site. During tactical reaction, the speaker notes that attackers are often sloppy, with mass logins from one address, so the advice is to wait before blocking. Strategic use turns those findings into high-fidelity alerts, historical hunts, and arguments for IT changes such as disabling legacy protocols. A low-effort option is flooding attacker data sets with fake credentials to add friction.

Measuring effect is hard. Useful signs include behavioral attribution, fewer password resets, attackers shifting to VPNs or paying more for hosting, and evidence that helps takedown requests, though some bulletproof hosts ignore those. The takeaway is that practitioners can impose real costs on adversaries using cheap, creative friction and make them spend time on defense.