Modern attackers are using social engineering, CAPTCHA gates, and legitimate remote management tools to turn phishing into a remote-access risk.