phishing-campaign

Security Concepts

Definition

A phishing campaign is a **coordinated series of phishing attacks** that share a common goal, theme, or infrastructure, designed to trick multiple targets over a period of time.

Instead of sending one-off phishing emails, attackers plan a campaign much like a marketing team would — picking a target audience, crafting believable messages, and using consistent “branding” to increase their success rate.

Typical characteristics of a phishing campaign include:

* **Common lure** – A repeated theme, like fake bank alerts, unpaid invoices, or urgent security notices.
* **Shared infrastructure** – The same lookalike domains, IP addresses, or hosting services across messages.
* **Multiple delivery waves** – Emails, texts, or calls sent in batches over days or weeks.
* **Automation** – Mailing lists, phishing kits, and scripts to send thousands of messages.
* **Goal alignment** – Credential harvesting, malware delivery, or initiating fraud.

Example:
An attacker might register `secure-paypal-login.com`, host a fake PayPal login page, and send 50,000 emails with the subject “Your account has been suspended – verify now.” The campaign may run for weeks, with tweaks to the message or website if early versions are blocked.

In investigations, recognizing a phishing campaign often means:

* Spotting multiple phishing emails with the same sender patterns or wording.
* Seeing several domains pointing to the same IP over a short time frame.
* Detecting recurring malware file hashes in attachments.
* Linking different victims through shared phishing indicators.

Real-world examples:

* **Operation Phish Fry (2009)** – Targeted financial institutions worldwide using hundreds of spoofed domains.
* **Office 365 Credential Harvesting Campaigns** – Continuous waves of fake login portals sent to corporate users to steal cloud credentials.
* **Google Docs Phish (2017)** – Large-scale, highly convincing phishing links disguised as document sharing requests.

Further reading:

* CISA: [https://www.cisa.gov/spotlight-phishing](https://www.cisa.gov/spotlight-phishing)
* Microsoft Security Blog on Phishing Campaigns: [https://www.microsoft.com/security/blog/tag/phishing/](https://www.microsoft.com/security/blog/tag/phishing/)
* MITRE ATT\&CK (T1566 – Phishing): [https://attack.mitre.org/techniques/T1566/](https://attack.mitre.org/techniques/T1566/)
* Proofpoint Threat Reports: [https://www.proofpoint.com/us/resources/threat-reports](https://www.proofpoint.com/us/resources/threat-reports)

phishing-campaign

Definition

Explore More Terms