Clisec
ProductsAnti-spamPrecise filtering of spam and bulk campaigns, without penalizing legitimate mail.Anti-phishing & BECStops impersonation, malicious links, and email fraud before the inbox.cPanel® pluginOne agent protects the whole server; each user manages from their cPanel.Explore
PricingGuidesContactAbout us
Start freeLog in
Guide · Credential theft

Credential phishing: fake login pages

How fake login pages that steal email, webmail and Microsoft 365 passwords work, how to recognize them, and what to do if an account was compromised.

Updated on 7 min readClisec team

In short

Credential phishing sends the user to a copy of a login page (webmail, Microsoft 365, Google, the bank) to steal their password. With that password the attacker reads the mail, sends spam from your server, or sets up a bigger fraud. It's recognized by checking the page's real domain, and stopped by inspecting links and their destination pages before the email reaches the inbox.

How it works

  1. An email arrives with a pretext: "your mailbox is full," "your password expires today," "you have a shared document," "pending voicemail."
  2. The link leads to a page identical to the company's webmail or to Microsoft 365.
  3. The user types their email and password. The page saves them and redirects to the real page so they don't suspect anything.
  4. The attacker gets into the mailbox, creates forwarding rules, and uses it to steal information or send more phishing.

Some kits act as a middleman between the user and the real page, and also capture the two-factor verification code. That's why SMS or code-based verification alone isn't enough.

Tricks used to dodge filters

  • Links to legitimate services: forms, shared documents or cloud storage that no list blocks.
  • Redirect chains: the first link is harmless and only the third or fourth leads to the fake page.
  • Pages that change: they show normal content to scanners and the fake page only to people.
  • QR codes instead of links. We explain this in the QR code phishing guide.
  • HTML attachments that open the fake page from the computer itself. See HTML smuggling.

How to recognize a fake page

  • Look at the full domain in the browser bar, right to left: webmail.yourcompany.cl.verify-account.com is not your company.
  • Be wary of any email that leads you to log in. It's safer to type the webmail address yourself.
  • The padlock (HTTPS) proves nothing: fake pages have it too.
  • If your password manager doesn't offer to autofill, it's probably not the real site.

What to do if someone handed over their password

  1. Change that account's password immediately, along with any other service that used the same one.
  2. In cPanel, check Email › Forwarders and Email Filters for that account: attackers create rules to forward or hide messages.
  3. Check Track Delivery to see if the account sent bulk mail.
  4. Notify contacts if the mailbox was used to send phishing.
  5. Turn on two-factor authentication wherever available, and use security keys or passkeys if you can.

How to prevent it on your server

The most effective defense is making sure the email never arrives. Clisec inspects links and destination pages on every incoming email, and blocks credential-stealing forms before delivery, across every account on the server.

Frequently asked questions

Does the browser padlock mean the page is safe?

No. It only means the connection is encrypted. Phishing pages use HTTPS too.

Does two-factor authentication prevent account theft?

It greatly reduces the risk, but some phishing kits capture the code too. Security keys and passkeys resist this type of attack better.

Why do attackers target hosting email accounts?

Because a compromised mailbox lets them read information, send spam from a server with good reputation, and deceive that account's contacts.

Protect every account on your server

Clisec inspects links and destination pages, and blocks credential-stealing forms across every account on your cPanel server.

Request a demoSee pricing and coverage

Keep reading

Guide · QuishingQR code phishing (quishing): how it works and how to avoid itThe link hidden inside an image: why it dodges filters and why it ends up on a phone.ReadGuide · Spear phishingSpear phishing: what it is and how to protect your teamPhishing written for one specific person: how it's prepared, how to spot it, and how to stop it.Read