Phishing unmasked: Trends, techniques, and free tools for analysis

Phishing is still one of the most stubborn and fast-changing threats in cybersecurity. Even though most organisations have some level of email security in place, attackers are always one step ahead - getting smarter, sneakier, and better at tricking people. They use clever psychological tactics, impersonate trusted sources, and sneak payloads past even well-defended systems.

This session takes you inside the mind of a security analyst as we unpack how phishing has evolved - and what you can do about it. We’ll walk through real examples, from classic credential grabs to targeted scams that feel unsettlingly real. You’ll see how attackers build trust, design convincing lures, and deploy payloads that slip under the radar. We’ll cover tactics like HTML smuggling, QR code phishing (quishing), fake login pages, browser-in-the-browser tricks, and domain spoofing.

We’ll also look at the evolution of phishing - from early spammy scams to the use of AI tools like ChatGPT to write persuasive bait, or deepfakes to impersonate real people. You’ll learn about threats like ClickFix, where users are manipulated into running malicious commands under the guise of fixing a problem, and HEAT (Highly Evasive Adaptive Threats), which dodge browser-based filters using dynamic content. Tools like Evilginx now allow attackers to sit quietly between users and their sessions, capturing credentials and bypassing MFA. Brand impersonation—Microsoft, Google, DocuSign - is still on the rise, too.

But this session isn’t about fear - it’s about action. We’ll explore how phishing analysts think: how they spot red flags, pivot from one clue (like a shady link) to uncover a wider infrastructure, and use passive DNS and WHOIS lookups to build the story. You’ll also see how red teamers could craft convincing phishing emails, giving you the attacker’s perspective to strengthen your defences.

Then we’ll get hands-on with free and open-source tools that make phishing analysis doable - even for resource-limited teams. You’ll learn how to use:

We’ll also take a quick look at what’s next. As VR, AR, and AI continue to grow, so do new phishing frontiers: deepfake impersonation in video calls, fake prompts in virtual offices, and AI-generated, hyper-personalised lures at scale. The phishing of the future won’t just hit inboxes - it could arrive through a headset, a smart assistant, or a spoofed 3D object in your virtual workspace.

This isn’t just a lecture - it’s a practical, human session for anyone defending their organisation, whether you're a SOC analyst, a cybersecurity student, or an IT generalist wearing many hats. You’ll leave with tools, insight, and confidence to take on phishing - today and tomorrow.