Module 2 · Initial Access — Phishing & Beyond 🔒

Initial access is how you get the first foothold: a user clicking your phishing link, a password spray landing on a weak account, an exposed service with a known CVE. For most red teams in 2026, initial access is still phishing. This module covers phishing infrastructure, payload delivery, and the alternatives when phishing fails.

The initial access menu in 2026

• Phishing: macro-enabled documents are dead, but HTML smuggling, container files (ISO, VHD, IMG), LNK with embedded payloads, and OAuth consent phishing all work
• Credential stuffing: leaked credentials from breaches reused at your target. Especially productive against external auth portals (VPN, Citrix, Exchange OWA)
• Password spray: single password (Season2026!, Company@2026) tried against every account. Slow enough to avoid lockouts
• Exposed services: vulnerable externally-reachable software. Confluence, Exchange, ManageEngine, old VPN appliances
• OAuth/consent phishing: tricking users into granting a malicious app permissions to their M365 account. Sidesteps MFA
• Supply chain: compromise a vendor who has access. Usually off-scope for red team engagements but worth naming
• Physical / drop attacks: USB drops, rogue access point, badge cloning

Phishing infrastructure

Minimum viable phishing setup:

• Domain: an “aged” domain with reputation — 6+ months of passive existence, some benign web content. Freshly-registered domains are blocked by modern email security
• Sending infrastructure: SPF, DKIM, DMARC correctly set up (so you pass authentication). Warm up the IP gradually
• Payload delivery: link to your site, which serves HTML that delivers the payload — direct attachments are scanned hard
• Redirector tier: cheap VPSes that proxy to your backend C2. Lose a redirector, rotate quickly
• TLS: Let’s Encrypt works but shorter validity. Reputable TLS signals “legitimate” to scanners
• Tracking: unique URL per target; log who clicked, what User-Agent, whether they entered credentials

Payload options for 2026

Microsoft disabled VBA macros from internet-sourced docs by default in 2022. Payload delivery shifted:

# MSOLSpray — Azure/M365 password spray
msolspray users.txt 'Spring2026!'

# Spray at a realistic pace: 1 attempt per account per hour, during business hours
# Smart-lockout thresholds at most orgs don't trigger at this pace