Human-operated phishing is a social engineering campaign in which a real attacker actively steers the victim through the scam, instead of relying only on mass, automated messages. The operator can answer questions, change the lure, and push the target toward a login page, approval prompt, or account-linking flow. That flexibility makes the attack harder to spot than a fixed phishing template.
In cyber security, this matters because the attack often targets identity controls rather than malware delivery. Victims may be tricked into entering credentials, approving MFA prompts, or granting access to a connected app. Defenses include phishing-resistant MFA such as passkeys or security keys, strong verification of login domains, and careful review of any prompt that asks to link or authorize an account. Treating those prompts as privilege-grant events helps reduce account takeover risk.