Credential phishing
Credential phishing is deception intended to make someone disclose authentication secrets, such as a password, to an attacker.
Collecting secrets through a fake sign-in
An attacker can send a link to a page that imitates a trusted service and asks for authentication information. MITRE describes phishing links to credential-harvesting sites. A familiar logo does not tell you who receives what you type.
Consent phishing asks for an app permission grant instead of a password. With adversary-in-the-middle phishing, the fake page relays a real sign-in, so the exposure can extend beyond the secret someone typed. Record what the person submitted or approved, not just that they clicked a link.
If someone entered a password
Treat a password entered on a fake page as potentially exposed, even if the employee stopped at the next prompt. Record the URL, approximate time, affected account, and actions taken, but not the password itself.
Then check what happened next. Visiting a page, submitting a secret, approving authentication, and accessing an account are separate steps. The identity team can determine which credentials to replace and which logs to check for subsequent use.
Authentication methods affect the risk
NIST distinguishes phishing-resistant cryptographic authentication from manually entered codes that an impostor can relay. Training people to spot suspicious requests is useful, but it does not supply the cryptographic protection of a phishing-resistant method.