Phishing.

What is phishing?

CISA says phishing is a form of social engineering. Phishing attacks use email or malicious websites to ask for personal information by posing as a trustworthy organization. The UK NCSC describes it as scam emails or text messages that contain links to malicious websites. Those sites may spread malware or trick people into revealing sensitive information or sending money.

How does it work?

CISA explains that attackers pretend to be a legitimate organization, such as a bank, and often claim there is a problem with an account. When the victim hands over the information, the criminal can use it to get into accounts. In simple terms, there is a lure, which is the message, and a capture, which is what you give away when you reply or type into a fake page.

What forms does it take?

• Mass campaigns sent to many people at once.
• Spear phishing, which the NCSC describes as targeted attacks that use personal information about employees.
• Vishing, which CISA describes as voice based social engineering through phone systems and VoIP.
• Smishing, which CISA describes as text messages with malicious links or phone numbers.

Why does it matter?

Phishing targets people, so it can work even when systems are well configured. Anyone with an email address or a phone number can receive it, and customers can be targets as well as staff. A single successful message can give an attacker a password or lead to malware or a payment to the wrong place. This is why the NCSC treats it as something to defend against in several layers, not only with training.

How can you spot it?

CISA lists these warning signs:

• Sender addresses that imitate real businesses.
• Generic greetings such as Dear Valued Customer.
• Links whose real destination does not match the text shown.
• Spelling mistakes and poor formatting.
• Unexpected attachments.

How do you defend against it?

The NCSC recommends four layers. First, block it at the source with anti-spoofing controls, namely DMARC, SPF and DKIM, together with email filtering. Second, support users with awareness training, while avoiding punishing phishing simulations that damage trust and discourage reporting. Third, limit the damage if a message gets through, with malware protection, multi-factor authentication, password managers and up to date devices. Fourth, respond quickly, with ways to detect incidents and a response plan.

CISA adds that you should check unknown callers directly with the organization, never share personal information by email, use multifactor authentication, use email filters, and report suspected attacks.

Is phishing the same as spear phishing?

No. Spear phishing is one kind of phishing. It is written for a chosen person or small group, using personal details, while ordinary phishing is sent widely.

Is phishing the same as social engineering?

Phishing is one form of social engineering. Social engineering is the wider idea of tricking people, and it also includes phone calls and other methods.

A forged sender address, known as email spoofing, is one way to make a phishing message look trusted.

Related pages in the Knowledge Hub

• Phishing 101
• Phishing technique (MITRE ATT&CK T1566)
• Phishing and lookalike domains

Sources

• CISA: Phishing is a form of social engineering using email or malicious websites; forms, red flags and defenses.
• UK NCSC: Four layers of defense: block at source, support users, limit damage, respond quickly.