The tester is conducting a phishing attack by cloning the company's login page to steal employee credentials.

Option A (BeEF) ❌: BeEF is used for browser exploitation, not phishing.

Option B (theHarvester) ❌: Used for OSINT, gathering emails, but does not conduct phishing attacks.

Option C (SET - Social Engineering Toolkit) ✅: Correct.

SET allows testers to clone web pages and perform phishing attacks.

Option D (GoPhish) ❌: GoPhish is a phishing simulation tool, but SET is specifically designed for credential harvesting.

???? Reference: CompTIA PenTest+ PT0-003 Official Guide – Social Engineering & Phishing Attacks