Phishing – Ask and ye shall receive

This report describes Fox-IT's Invoke-CredentialPhisher, a PowerShell-based post-exploitation tool and Cobalt Strike module that leverages authentic-looking Windows toast notifications and real credential prompt dialogs to trick users into submitting credentials. The write-up details technical implementation (base64 in-memory loading of a PoshWinRT wrapper, AppID and icon spoofing, hide/show process techniques), sample phishing scenarios (Outlook reconnect, updates, password expiry), command-line examples, and recommends enabling PowerShell logging and increasing user awareness.