Most spear phishing attacks start with the attacker reaching out. This one started with a contact form on the target’s own website. We filled it in ourselves.
No spoofed domain. No fake IT support call. Just a plausible pretext, and a Business Development Director doing his job.
Setting up the spear phishing attack
Using the target’s own contact form wasn’t random. Their platform sends the message. Which means delivery’s almost guaranteed.
And if anyone replies, they’re the one starting the conversation. Harder to flag. Easier to trust.
The pretext: a construction company looking to expand, needing consultancy on fund administration and servicing. The kind of inquiry that looks like someone did their homework.
Polite. Specific. Unhurried.
One click
Their Business Development Director replied by email, introduced himself, and asked to arrange a meeting.
We said our partnership requirements were specific, and it would be worth reviewing them before going further. Then we sent the link.
He clicked it. Entered his credentials. Session hijacked.
That’s session hijacking: no need for his password again, just his live session, and by then, we already had it.
His next message: “The link didn’t work. Can you send an attachment instead?”
The real vulnerability
No elaborate infrastructure, no impersonation of internal staff, no fake IT support call. Just a contact form, a plausible story, and a Business Development Director doing exactly what his job description says: following up on a lead.
Here’s the catch: the entry point wasn’t a vulnerability in their technology. It was a feature of their sales process.
The downstream effect: a hijacked session at this level typically hands over more than a login. It can mean his inbox and his calendar. It can mean impersonating him with real clients and partners. Depending on what his session covered, it might also reach CRM records or deal data.
Your public-facing channels aren’t just marketing tools. In the wrong hands, they’re an invitation.
The Business Development Director is still following up on leads. He doesn’t know one of them was us.
Why this stops here
This engagement was scoped to prove the entry point and the initial compromise, not to chase it further. We stopped at the session hijack because that’s what the brief called for.
A real attacker wouldn’t stop there.
Credential and session hijack is already a critical finding on its own. It’s the point where a security team treats the account as compromised, not a step toward deciding whether it is.
The action this requires: revoke the session, rotate the credentials, and check what else that account could reach, before assuming the story ends where the test did.
Want to see what an attacker sees when they look at your front door?
Contact CovertSwarm to find out.