--- title: "No Matter How You Sign in These Attackers Have You Phished | DuoCircle" description: "Do you ever use an online service that gives you multiple ways to sign in?" image: "https://www.duocircle.com/images/og-default.png" canonical: "https://www.duocircle.com/blog/phishing-protection/no-matter-how-you-sign-in-these-attackers-have-you-phished/" --- Quick Answer Federated sign-in is now a phishing surface. Services like Dropbox let users authenticate with Google, Yahoo, Microsoft 365, and other providers, and Information Security Buzz documented an attack that builds replica login pages for each option. The fake pages copy logos, fonts, and colors from each brand, and some include working password-reset flows, secondary email prompts, and security questions to add realism. Awareness training doesn't reliably catch this because the visual cues match the real provider exactly. The defense the post recommends is real-time link click protection that inspects the underlying HTML rather than the visual rendering, on the principle that the code can't lie about where the link goes. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fphishing-protection%2Fno-matter-how-you-sign-in-these-attackers-have-you-phished%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=No%20Matter%20How%20You%20Sign%20in%20These%20Attackers%20Have%20You%20Phished&url=undefined%2Fblog%2Fphishing-protection%2Fno-matter-how-you-sign-in-these-attackers-have-you-phished%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fphishing-protection%2Fno-matter-how-you-sign-in-these-attackers-have-you-phished%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fphishing-protection%2Fno-matter-how-you-sign-in-these-attackers-have-you-phished%2F&title=No%20Matter%20How%20You%20Sign%20in%20These%20Attackers%20Have%20You%20Phished "Share on Reddit") [ ](mailto:?subject=No%20Matter%20How%20You%20Sign%20in%20These%20Attackers%20Have%20You%20Phished&body=Check out this article: undefined%2Fblog%2Fphishing-protection%2Fno-matter-how-you-sign-in-these-attackers-have-you-phished%2F "Share via Email") ![phishing attack](https://media.mailhop.org/duocircle/images/2020/02/buy-smtp-7891.jpg) Do you ever use an online service that gives you multiple ways to sign in? For example, there’s the online storage service Dropbox which lets you login with your Google credentials, Yahoo credentials, Office 365 credentials and others. Seems very convenient, because you don’t have to remember as many login credentials. Well guess what? _Attackers know that and they’re now using it to phish you_. According to the folks over at [Information Security Buzz](https://www.informationsecuritybuzz.com/articles/beware-phishing-attacks/), they’ve “uncovered an alarming type of **phishing attack** that is based on so-called replica sign-in pages for federated account log-ins. _This type of attack works by playing into the human brain’s tendency to give priority to well-known visual icons_. Replica phishing pages carefully duplicate the logos, colors and fonts from popular global brands such as Google, Microsoft, Dropbox and Yahoo. These imitations are often so realistic that they lure users into giving away their credentials.” You can login to Dropbox using any credentials you want because the attackers have created a fake **phishing login page** for all of them. And how realistic are these phishing login pages? “Some of these log-in pages come complete with a functional Password Reset option. Others include requests for secondary email accounts, mobile phone numbers, or one’s answers to security questions to ostensibly provide enhanced security.” Yeah, that realistic. The article goes on to correctly conclude, “_Many security professionals try to offset the risk from these sorts of attacks by training their employees on how to identify and avoid such fake sign-in pop-ups and web pages_. However, the attackers are creating more sophisticated and legitimate-looking phishing attacks every day, which can be quite hard to detect, such as in the examples above. And despite a growing focus on user **awareness and training** sessions, a distracted, multi-tasking workforce is still fallible, and will still make mistakes.” [![email security ](https://media.mailhop.org/duocircle/images/2020/02/dmarc-report-2791.jpg)](https://media.mailhop.org/duocircle/images/2020/02/dmarc-report-2791.jpg) In other words, you can’t “train” you way out of these attacks. They’re too sophisticated and some employees are going to fall for them. So, what should you do? _Get yourself some protection that doesn’t fall for any of these tricks, no matter how clever they are_. Get yourself [Phishing Protection](/email/phishing-protection) from DuoCircle. **Phishing Protection** from DuoCircle is cloud-based [email security software](/) with **real-time link click protection**. So, no matter how clever the attack, Phishing Protection doesn’t fall for it because it doesn’t look at the realistic looking logos, _it looks at the underlying HTML code. And the code doesn’t lie_. Try Phishing Protection from [DuoCircle](/) risk free for 30 days. _It takes just 10 minutes to set up, works with all email services and costs only pennies per month per user_. You’re no match for these types of phishing attacks, but DuoCircle is. Start protecting your users today. ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) Brad Slavin General Manager General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio. ## Secure your email infrastructure Protect, authenticate, and deliver. Contact our team to find the right solution. [Contact Sales](/contact/) [Explore Products](/products/) Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fphishing-protection%2Fno-matter-how-you-sign-in-these-attackers-have-you-phished%2F) [ ](https://twitter.com/intent/tweet?text=No%20Matter%20How%20You%20Sign%20in%20These%20Attackers%20Have%20You%20Phished&url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fphishing-protection%2Fno-matter-how-you-sign-in-these-attackers-have-you-phished%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fphishing-protection%2Fno-matter-how-you-sign-in-these-attackers-have-you-phished%2F) Copy Related Articles - [ ![AI-Generated Phishing](https://media.mailhop.org/duocircle/images/2026/04/spf-record-4522.jpg) AI-Generated Phishing Has Eliminated the Typo: Why Traditional Email Filters Are No Longer Enough Phishing ](/blog/ai-generated-phishing-eliminates-typos-making-traditional-email-filters-ineffective/) - [ ![spf-permerror-4555](https://media.mailhop.org/duocircle/images/2023/05/spf-permerror-4555.jpg) 10 Applications of ChatGPT that Hackers Are Already Exploiting Phishing ](/blog/phishing-protection/10-applications-of-chatgpt-that-hackers-are-already-exploiting/) - [ ![Email-Based Cyber-Attacks](https://media.mailhop.org/duocircle/images/2016/03/spf-record-tester-4455.jpg) 65% of Global Businesses Ill-Equipped to Defend Against Email-Based Cyber-Attacks Phishing ](/blog/phishing-protection/65-global-businesses-ill-equipped-defend-email-based-cyber-attacks/) - [ ![Email-based Ransomware Attacks](https://media.mailhop.org/duocircle/images/2018/02/email-smtp-service-7834.jpg) 7 Ways to Protect Your Organization from Email-based Ransomware Attacks Phishing ](/blog/phishing-protection/7-ways-protect-organization-email-based-ransomware-attacks/) ## Related Articles [ Phishing 11m AI-Generated Phishing Has Eliminated the Typo: Why Traditional Email Filters Are No Longer Enough Apr 28, 2026 ](/blog/ai-generated-phishing-eliminates-typos-making-traditional-email-filters-ineffective/)[ Phishing 5m 10 Applications of ChatGPT that Hackers Are Already Exploiting May 3, 2023 ](/blog/phishing-protection/10-applications-of-chatgpt-that-hackers-are-already-exploiting/)[ Phishing 4m 65% of Global Businesses Ill-Equipped to Defend Against Email-Based Cyber-Attacks Mar 29, 2016 ](/blog/phishing-protection/65-global-businesses-ill-equipped-defend-email-based-cyber-attacks/)[ Phishing 9m 7 Ways to Protect Your Organization from Email-based Ransomware Attacks Feb 11, 2018 ](/blog/phishing-protection/7-ways-protect-organization-email-based-ransomware-attacks/) ```json {"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"No Matter How You Sign in These Attackers Have You Phished","description":"Do you ever use an online service that gives you multiple ways to sign in?","url":"https://www.duocircle.com/blog/phishing-protection/no-matter-how-you-sign-in-these-attackers-have-you-phished/","datePublished":"2020-02-13T15:25:10.000Z","dateModified":"2025-06-06T17:49:58.000Z","dateCreated":"2020-02-13T15:25:10.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/phishing-protection/no-matter-how-you-sign-in-these-attackers-have-you-phished/"},"articleSection":"phishing-protection","keywords":"","wordCount":454,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2020/02/buy-smtp-7891.jpg","caption":"phishing attack","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"Phishing"},{"@type":"ListItem","position":3,"name":"No Matter How You Sign in These Attackers Have You Phished","item":"https://www.duocircle.com/blog/phishing-protection/no-matter-how-you-sign-in-these-attackers-have-you-phished/"}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"Phishing","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"No Matter How You Sign in These Attackers Have You Phished","item":"https://www.duocircle.com/blog/phishing-protection/no-matter-how-you-sign-in-these-attackers-have-you-phished/"}]} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"No Matter How You Sign in These Attackers Have You Phished","description":"Do you ever use an online service that gives you multiple ways to sign in?","url":"https://www.duocircle.com/blog/phishing-protection/no-matter-how-you-sign-in-these-attackers-have-you-phished/","datePublished":"2020-02-13T15:25:10.000Z","dateModified":"2025-06-06T17:49:58.000Z","dateCreated":"2020-02-13T15:25:10.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/phishing-protection/no-matter-how-you-sign-in-these-attackers-have-you-phished/"},"articleSection":"phishing-protection","keywords":"","wordCount":454,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2020/02/buy-smtp-7891.jpg","caption":"phishing attack","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ```