Which type of threat is often used in conjunction with phishing attempts and is often viewed as greatly increasing the likeliness of success?

Unvalidated redirects and forwards allow an attacker to craft a URL that appears to point to a legitimate site but then redirects the user to a malicious site without their explicit knowledge or consent. This is particularly effective in phishing campaigns because the initial, trusted domain name can mask the eventual malicious destination, greatly increasing the likelihood of a user falling victim.

Cross-site request forgery (CSRF) tricks a logged-in user into performing an action they didn't intend on a website where they are authenticated, but it's not primarily used in conjunction with phishing to increase the likelihood of initial success like a redirect is.

Cross-site scripting (XSS) involves injecting malicious scripts into legitimate websites to execute in a user's browser, typically used for session hijacking or defacement, not primarily for enhancing phishing success by luring.

Insecure direct object references (IDOR) allow attackers to access objects (like database records or files) they are not authorized to view by manipulating parameters in a URL, which is a different type of vulnerability than one that aids phishing.