Phishing is generally 1. run a command or 2. give me your credentials. To prevent these you need good solid technical controls like U2F for password based authe

Phishing is generally 1. run a command or 2. give me your credentials. To prevent these you need good solid technical controls like U2F for password based authentication (which is origin bound). Similarly binary whitelisting will prevent most users from running rogue executables.