Open Internet by MindsNet

A hacker pulled a succesfull phishing attack on an employee, what can he really do after?