Phishing

Social-engineering messages—typically email—crafted to trick recipients into revealing credentials, downloading malware, or approving malicious MFA prompts. It remains the most common initial access vector