Start with the cracks the attackers left showing. That was the advice one security professional, Dickson, gave after analyzing a phishing campaign that was both clumsy and clever at the same time. The cracks were everywhere, if you bothered to look. The sender supposedly came from “nthropic,” not Anthropic, the AI company whose name was being borrowed, but with the first letter simply chopped off. The body of the email carried GoTo Webinar branding. Clicking through to register led to a page designed to look like a Zoom meeting invitation. And when the victim reached the final step, the fake login screen borrowed the face of either Google or Microsoft. Three brands in three clicks. A normal person in a hurry might never notice. But the inconsistency is exactly the kind of clue that should make a security team sit up and pay attention. Attackers don’t care about brand consistency the way a marketing team would. They care about getting enough familiar imagery in front of a distracted person to trigger an automatic response. They know that a busy worker at the end of a long day is not reading every word or inspecting every URL. They are pattern-matching. And in that pattern-matching, the cracks are invisible. But to a defender, the cracks are also the beginning of a story. They reveal how the attack was assembled, what the attackers guessed about their victims, and where a technical control might have stopped it. Too often, after a phishing attempt, the instinct is to blame the person who clicked. The better instinct is to treat the attack as a fragile artifact—one that contains clues about the adversary and the weaknesses in our own systems. The cracks are not proof of failure. They are proof that someone tried, and they show us where to push back.
The fake login pages in this campaign were especially telling. Domains like office[.]com-access-sharepoint[.]com look strange when you dissect them, but they are built to be skimmed, not read. Your eye catches “office,” then it catches “sharepoint.com,” and your brain does the rest. It decides this is probably a legitimate Microsoft login page and moves on. No one stops to parse the punctuation or to notice that the actual domain name is something awkward and twisted. This is a classic trick, but it works because human vision is not a secure protocol. We see what we expect to see, especially when we are tired, rushed, or already anxious about a meeting that started five minutes ago. Security training tells people to hover over links, to check the domain, to read carefully. But Dickson was blunt about the limits of that approach: training helps, but he would not hang the defense on an employee squinting at a URL at 4:45 on a Friday. That image is worth sitting with. At 4:45 on a Friday, almost nobody is performing at peak cybersecurity alertness. They are thinking about the weekend, about a deadline, about the pile of emails still waiting. They are not thinking about the anatomy of a domain name. And if the entire security posture depends on one exhausted human being decoding a carefully deceptive URL, the attacker has already won. The URL is not meant to be read. It is meant to be recognized. That is a critical distinction. We train people to read, but the attack is designed for people who skim. The defense, therefore, has to be stronger than human attention. It has to be built into the systems themselves—into email filtering, into browser protections, into authentication flows that do not rely on a single password alone.
There was another crack in this campaign, one that might be easy to overlook. The Google impersonation page collected only usernames, not passwords. In a way, that was good news for would-be victims, but it was probably not the result of generosity. Dickson noted that this might have been a configuration error, and that the threat actors behind the campaign will likely fix it. That small detail is more important than it seems. It tells us that the attackers are still building their operation. They are learning, iterating, and testing. A page that only captures usernames can still be dangerous—it can produce a list of valid accounts to target later—but it is not a complete attack. The attackers will almost certainly add a password field the next time. They will also improve their branding. They will remove the missing “a” and tighten the inconsistencies. They will read their own campaign and find the cracks we have just described, and they will try to smooth them over. That is the uncomfortable truth about phishing. The attack you have just dissected is already being revised. So spending too much time celebrating the flaws is a mistake. The flaws are useful, but they are temporary. They give us a snapshot of where attackers are today, not where they will be tomorrow. The campaigns that fail or look silly now are often the predecessors of much sharper operations. They let attackers test what works, what gets clicked, what gets reported, and what gets ignored. Every round of training and every fire drill becomes data. The defenders need to learn faster than the attackers, and that means paying attention to the details that the attackers themselves were not careful about. A missing letter and a mismatched logo are not reasons to relax. They are reasons to prepare for the version that will not have those mistakes.
All of this raises a deeper question about how we think about security awareness. There is an old assumption that the end user is the weakest link, and that if we just train people hard enough, they will stop falling for phishing. But that assumption is both unfair and unrealistic. Human beings are not built to be security sensors. They are built to get things done, to trust, to move quickly through a world full of information. Asking them to be suspicious of every email, every link, and every login page is asking them to fight their own nature. It is possible to train people to be more aware, and that training is not worthless. It can reduce risk, improve reporting, and build a culture where security matters. But training is not a silver bullet. It does not work at 4:45 on a Friday. It does not work when someone is crying, or late, or distracted by a family emergency. It does not work when the attack is clever enough to match the exact context of a particular workplace. The attacker only needs one open door. The defender has to protect every door, every hour, every day. That imbalance is why we cannot rest the whole defense on an employee’s ability to squint at a URL. The employee is not failing a test when they click a well-crafted link. They are doing exactly what the attack was designed to make them do. Blaming them is comfortable, but it is not a strategy. The strategy has to be to make the click less dangerous, to contain the damage before it spreads, and to design systems that do not depend on perfect human vigilance. People will make mistakes. The question is whether the organization is built to survive those mistakes.
And that is where leadership comes in. Dickson made a powerful observation: how much a stolen password is worth is a leadership decision, not a test the employee fails. This is the heart of the matter. A password is not valuable all by itself. Its value depends on what it can open. If a single password unlocks access to everything—email, file shares, financial systems, customer data—then that password is extremely valuable, and phishing will always target it. If a password is only the beginning of a much longer identity verification process, its value drops. Leadership decides whether the castle has one giant gate or a series of locked inner doors. Leadership decides whether a compromised account can be quickly detected and neutralized, or whether it can quietly roam through the network for weeks. Leadership decides whether employees use multifactor authentication, whether privileged accounts are carefully managed, whether access is limited to what each person actually needs. These are not technical side details. They are risk management decisions. Every organization has limited resources and unlimited threats. A leader who understands security knows that the goal is not to eliminate phishing—that is nearly impossible. The goal is to reduce the payoff of a phish. If a stolen password is worth almost nothing because the attacker still cannot log in without a second factor, and the second factor is tied to a device, and the device is tied to an unusual login pattern, then the phishing attack loses its power. If a stolen password is worth everything because it opens the kingdom, then no amount of training will save you. The employees are not the final firewall. The architecture is. And the architecture is a leadership choice, not an employee behavior.
So what does it mean to start with the cracks? It means looking at a phishing attempt and asking hard questions instead of asking who is at fault. What did the attacker reuse? What did they get wrong? What did they almost get right? What does the fake domain tell us about our own blind spots? Why did the branding feel familiar enough to fool someone? What would have happened if the login page had collected the password too? Could we have contained the damage? Would we have noticed the intrusion? These questions turn a moment of embarrassment into an opportunity for real improvement. The cracks in an attack are also cracks in our assumptions, and if we are willing to look through them, we can see the shape of what is coming. The attackers are going to get better. They are going to fix the missing letter. They are going to make the pages more convincing. They are going to align the brands and polish the domains. They are going to test new ways around the barriers we build. That is the nature of the game. But we can get better too. We can stop pretending that human beings are reliable security devices. We can build systems that catch the click before the attacker can exploit it. We can invest in detection, response, and recovery. We can make sure that a stolen password is not a skeleton key. And we can remember that the person who clicked at 4:45 on a Friday is not a villain. They are a person doing their job, in an environment that someone else created. The responsibility for that environment belongs higher up. The cracks the attackers left showing are not just flaws in their campaign. They are invitations for us to do our work better—without blame, without fear, and with a clear-eyed understanding of the people we are all trying to protect. At the end of the day, security is not about catching the one person who slipped. It is about building a world where slipping is survivable.