# After a phishing click, how do attackers get from one laptop to the rest of the network?

Usually in a few predictable steps. The malicious file or link gives them a remote-control channel back to their own server, which shows up as regular outbound connections. They then look around: which servers, shares and accounts exist, often by scanning the internal network or querying the directory. Next they collect more credentials, from the laptop's memory, saved browser passwords or other systems, and use them to log in to other machines with normal admin tools such as remote desktop, remote PowerShell or file shares. From there they aim for the domain controller, the backups and the data stores. Each step leaves a network trace: new connections between internal machines that rarely talk, scanning, admin protocols coming from an ordinary laptop, and data moving to unusual places. Those traces are what network detection and response (NDR) watches for, and why a phishing click does not have to end in a full breach.

FAQ: [Phishing and e-mail aftermath](https://netsenx.com/en/faq/phishing) · https://netsenx.com/en/faq/how-attackers-move-from-a-phished-laptop-to-the-network

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [Should employees report a phishing e-mail even if they did not click it?](https://netsenx.com/en/faq/should-employees-report-phishing-they-did-not-click)
- [Does security awareness training stop phishing?](https://netsenx.com/en/faq/does-security-awareness-training-stop-phishing)
- [What is spear phishing?](https://netsenx.com/en/faq/what-is-spear-phishing)
- [What are smishing and vishing?](https://netsenx.com/en/faq/what-is-smishing-and-vishing)
- [What is QR code phishing?](https://netsenx.com/en/faq/what-is-qr-code-phishing)