Credential phishing is obtaining a user ID, email address, and password by pretending to be a respectable or well-known company, individual, or business through an email, instant message, or other form of contact. The attackers then assault a secondary target using the victim's credentials.