Phishing
One email. One compromised account.
A step-by-step simulation that reproduces a real attack: a fraudulent email, a fake Microsoft login page, and the reveal of the warning signs.
- Realistic email
- Microsoft 365 clone
- Credential capture
Step-by-step simulation
Follow the attack from inbox to stolen credentials
Four steps, a few seconds for the attacker. Move at your own pace to see what the victim doesn't.
Leave schedule — approval needed
Scheduled update tonight — no action needed
Re: Q2 project meeting
The victim is working normally
Their inbox is open. The attacker already has their address — the campaign is being sent.
The attacker collects addresses from LinkedIn, the company website or past leaks. The email is personalized with the first name, job title and IT department to maximize credibility. This is spear phishing.
Key figures
Phishing is still the #1 way in
- Phishing emails
0,0B
sent every day worldwide- Of targeted users
0%
fail to spot an elaborate phishing attempt- Of cyberattacks
0%
start with a fraudulent email
Red flags
5 signs that should raise the alarm
An elaborate phishing email looks like the real thing. These clues almost always give it away.
Spoofed sender
The domain looks right but isn't: microsoft-notif.net, amaz0n.com…
Artificial urgency
"Your account expires in 24h": pressure pushes you to act without checking.
Misleading link
On hover, the URL doesn't match the company's official domain. A link rewritten by your mail system (safelinks.protection.outlook.com, urldefense.proofpoint.com) hides its real destination.
Errors and inconsistencies
Clumsy spelling, slightly off layout, generic signature.
Sensitive request
Credentials, MFA code or payment: no legitimate service asks for them by email.
Right reflexes
Clicked? Act in this order
The first minutes matter: each step shrinks the attacker's window of opportunity.
- 1
Isolate the device
Disconnect the machine from the network (Wi-Fi and cable) to stop any spread.
- 2
Change the password
From another clean device, on the targeted account and anywhere it was reused.
- 3
Enable MFA
Two-factor authentication blocks the use of a stolen password.
- 4
Report the incident
Alert your IT or security team immediately, then report the email.
- 5
Check sign-ins
Review recent sign-ins, forwarding rules and devices linked to the account.
Interactive demo
Live the attack from the inside
Four realistic scenarios — email, clone, SMS, call — to recognize manipulation techniques before falling victim to them.
An email targeted at a specific employee
Spear Phishing
The attacker uses real information (first name, company, context) to make the email credible and bypass the victim's natural wariness.
Interactive demo — follow the steps
Account suspended ⚠️
Action required within 24h
Maintenance this weekend
⚠️ Your Microsoft account is temporarily suspended
We detected unusual activity on your account. Your access has been temporarily suspended.
To avoid permanent deletion of your mailbox within 24 hours, confirm your identity.
💡 Hover over the button to see the destination URL
Attack analysis
- ·A personalized, urgent subject line with real context
- ·A sender mimicking an official domain with a subtle typo
- ·A redirect to a perfect clone of the login page
Best practices
- →Check the sender's full domain, not just the displayed name
- →Access services by typing the URL directly into your browser
- →If in doubt, contact the sender through another channel
FAQ
Phishing FAQ
How do you recognize a phishing email?
Red flags of a phishing email include: a sender address that mimics a legitimate domain (e.g. support@amaz0n.fr), an artificial sense of urgency, a URL that doesn't match the official domain on hover, spelling mistakes, and a request for credentials or payment.
What is phishing?
Phishing is a social engineering attack where an attacker impersonates a trusted entity (a bank, Microsoft, DHL...) via email to steal credentials, banking information, or install malware. It's the number one attack vector behind security incidents.
What should you do if you clicked a phishing link?
Immediately: disconnect the machine from the network, change the compromised account's password from another device, enable MFA, report the incident to IT/security, and check recent sign-ins on the targeted account.
What's the difference between phishing and spear phishing?
Mass phishing sends identical emails to thousands of people. Spear phishing is targeted: the attacker personalizes the message with information specific to the victim (name, job title, colleagues) to increase the success rate. Whaling specifically targets executives.
Train your teams against phishing
Simulated phishing campaigns, awareness workshops and tailored training so your people become your first line of defense.