Credential phishing explained – what it is and what to do about it
Credential phishing explained – what it is and what to do about it
< BLOG
Credential phishing: how fake login pages steal user accounts
Credential Phishing uses a fake login page to collect account details from someone who believes they are signing in to a genuine service. The attacker may copy your branding and use a convincing website, then request a username, password, and even a temporary MFA (multi-factor authentication) code. If those details are submitted, the attacker can attempt to access the real account immediately, before the victim realises the login page was fraudulent.
The criminal does not need to guess the password if someone gives it to them.
A message says an account has been locked, a payment failed, a document is waiting, or suspicious activity has been detected. The recipient follows the link and sees a familiar login page.
They enter their email address and password.
The page may then ask for the six-digit code from their authenticator app, or prompt them to approve a sign-in notification. Everything appears normal because the attacker has copied the expected sequence.
But the page is not connected to the real service. It is collecting the information and passing it to the criminal, often in real time.
Credential Phishing is not always a technical break-in. It is a deception problem. The attacker uses a convincing website and a familiar-looking page to persuade someone to hand over the keys.
That is why The TLD Project helps businesses identify fake websites and cloned login pages before they are used to target customers, staff, or suppliers.
Credential phishing
Credential Phishing is a form of phishing that aims to steal login information: usernames, passwords, recovery details, security questions, session information, or multi-factor authentication codes.
The attacker usually begins with a reason to create urgency or concern. It could be an account-verification request, overdue invoice, failed delivery, password reset, support ticket, shared document, or security alert.
The link leads to a fake page that is designed to resemble the genuine login experience. The page may copy branding, fonts, colours, language, and page layout. It may even redirect the victim to the real site after capturing their details, leaving them unaware that anything has happened.
Credential Phishing commonly uses a malicious website that mimics a company’s legitimate login portal. In documented attacks, victims have entered their username, password, and six-digit MFA code, enabling the attacker to authenticate to the genuine service.
How accounts are taken over
A stolen password can be enough if the account does not use multi-factor authentication. However, many Credential Phishing attacks are designed to capture more than one piece of information.
The attacker may collect:
- A username and password.
- A temporary MFA code from an authenticator app or text message.
- An approval to a push notification.
- Password-reset details or recovery codes.
- A cookie or session token that keeps the victim signed in.
- Personal details needed to answer account-recovery questions.
The attacker may then sign in before the temporary code expires. If successful, they can change account settings, create forwarding rules, access invoices and contact lists, download customer data, or use the account to send further phishing messages.
Traditional MFA (multi-factor authentication) still provides important protection, but it can be bypassed when a victim enters a one-time code into a live fake login page. Phishing-resistant authentication methods such as FIDO-based security keys are designed to prevent credentials captured by a fraudulent site from being replayed against the genuine one.
Why businesses are affected
Credential Phishing can target your customers, but it can also target the people running your business.
A customer-account compromise can lead to unauthorised orders, data exposure, refund fraud, and support costs. A compromised employee account can be more serious: email access, cloud storage, finance systems, customer records, software administration, and supplier communications may all be exposed.
Attackers often use a stolen business email account to make their next message more convincing. They can reply within genuine email threads, request invoice payments, ask customers to reset passwords, or impersonate a director or finance contact.
This is why a fake login page is rarely an isolated issue. It can be the start of account takeover, payment diversion, data theft, or further impersonation.
What to do after a suspected attempt
If someone has entered credentials into a suspected fake page, act quickly. Change the password through the genuine site—not through the original link—and end active sessions where the service allows it. Review recent account activity, forwarding rules, recovery settings, payment information, authorised devices, and any unfamiliar access.
For a business account, investigate whether the attacker accessed email, cloud files, customer systems, or financial platforms. Tell affected users what has happened through trusted communication channels, and ensure staff know how to report similar messages quickly.
Preserve evidence of the fake page: the full URL, screenshots, the original message, sender address, email headers, and the time it was accessed. Do not return to the page to test it, enter new credentials, or attempt payment.
The TLD Project helps SMEs monitor suspicious brand-related websites, identify cloned login pages, and prepare evidence-led action against Credential Phishing infrastructure.
