Create 09-red-team-phishing-lifecycle.md

Author: ngvuthdanhh

notes/09-red-team-phishing-lifecycle.md

@@ -0,0 +1,16 @@
+# 09 – Phishing Lifecycle (from DFIR View)
+
+Stages:
+1. Recon  
+2. Target selection  
+3. Infrastructure setup  
+4. Lure creation  
+5. Delivery  
+6. Exploitation  
+7. Persistence  
+8. Exfiltration  
+
+## DFIR Focus
+- Identifying points of compromise  
+- Tracing delivery method  
+- Reconstructing attacker timeline