Phishing 101.

Phishing is a trick. Someone sends a message that looks like it comes from a person or company you trust, and the message tries to make you do something: sign in on a page, open a file, pay an invoice or share a code.

In the MITRE ATT&CK catalog this is technique T1566, and the Knowledge Hub has a page on the phishing technique.

The word comes from fishing. The attacker throws out bait and waits to see who bites. Most messages go to many people at once, because a small share of replies is enough to make it worthwhile.

The goal is usually one of three things. The attacker may want your password, so they can sign in as you. They may want money, for example through a fake invoice or a changed bank detail. Or they may want you to run malware, which gives them a foothold on your device.

Phishing is different from most hacking because it does not break any software. It uses trust. That is why technical controls alone never solve it, and why people and process matter as much as tools.

Anyone can be a target: staff, customers, partners and executives.

People have known about phishing for a long time, and it still works. There are good reasons.

The messages are better. Attackers copy real logos and real wording, and they write clean text. Tools make it cheap to produce many convincing variations.

People are busy. Most of us read email quickly, often on a phone, where it is harder to check a sender or a link. A message that says an account will be closed today creates pressure, and pressure makes people skip checks.

The attack takes only one mistake. A company can have hundreds of careful people, and one tired click is enough.

Stolen data also feeds it. Information taken by an infostealer, such as saved passwords and session cookies, lets an attacker skip the fake page entirely or write a more believable message. Data from earlier breaches helps attackers use real names and real details.

Finally, the attack does not need to defeat your defenses. It goes around them, through a person who is allowed to do the very thing the attacker wants.

A typical phishing attack moves through a few clear steps.

First comes preparation. The attacker picks a target and studies it. For a mass campaign this may be only a brand to copy. For a targeted attack it means collecting names, roles and recent news from public sources.

Next the attacker builds the pieces: the message, a fake page and a place to host it. Often the page sits on a look-alike domain. Typosquatting, which means registering a name that is almost the same as yours, is a common way to do this.

Then the message goes out and creates urgency. The reader clicks, lands on the fake page and enters a login. The page records it and may pass it on to the real site, so the reader sees nothing odd.

The last step is use. The attacker signs in, reads mail, sets up forwarding rules, resets other accounts or sends further messages from the stolen account to reach more people.

Each step leaves a trace, and that is good news. The domain, the page and the sending pattern can all be spotted and acted on, if someone is looking.

Phishing comes in several forms, and the differences help you plan defenses.

• Mass email phishing. The same message goes to very many people and copies a well-known brand or service.
• Targeted phishing. A message written for one person or team, using real names, roles and projects. It is rarer but much more convincing.
• Business email compromise. The attacker poses as an executive or supplier to ask for a payment or a change of bank details.
• Text message and voice phishing. The same tricks over phone channels, where people tend to check less.
• Fake pages and ads. A page or advert that copies your brand and appears in search results or social media, reaching customers directly.
• Attachments and QR codes. A file or image that hides the link from simple filters.

A single phishing attack may combine several of these. For example, an email may lead to a phone call to confirm the request.

When you plan defenses, ask which of these forms could hurt your staff, and which could hurt your customers.

Start with the basics and add layers.

• Turn on multi-factor authentication everywhere you can, especially for email and remote access. Prefer methods that cannot be passed on to a fake page.
• Make reporting simple. One button or one address for suspicious messages, and a quick reply to the person who reported.
• Filter email, and block known bad links and attachments.
• Set clear rules for payments and bank changes, such as a call back on a known number.
• Train people with short, realistic examples, and share what the team has seen recently.

Do not forget the outside. Attackers copy your brand on domains and pages you do not control, and your own tools never see them. Brandefense Phishing Monitoring & Domain Abuse finds look-alike domains and phishing pages that use your brand and helps get them taken down.

When you find a malicious page, report it to the registrar and the hosting provider, and warn your customers if they are likely to see it.

Finally, plan for the day someone clicks. Make it easy to say so quickly, and have a clear process to reset the account and check what it did.

Teams that own the brand and customer trust can read how this looks from their desk on the brand and marketing lead page.

Measure behavior and speed, not just how many people fail a test.

• Reporting rate. Of the suspicious messages that reach people, how many are reported? A rising rate is a good sign, because it means people are paying attention and feel safe speaking up.
• Time to report. How long does it take from the message arriving to the first report?
• Time to contain. When someone does click, how long until the account is reset and checked?
• Time to takedown. When you find a fake page or domain that uses your brand, how long until it is gone?
• Repeat exposure. How often do the same people or teams get caught, and what would help them?

Count what you find outside as well. How many look-alike domains and fake pages did you detect, and how many were removed? A tool like Brandefense Phishing Monitoring & Domain Abuse can provide that view, but you should still set your own targets.

Avoid using click rates as a punishment. If people fear blame, they stop reporting, and reporting is the strongest signal you have. Review the figures with the team every few months and adjust.

These public pages back the descriptions in this guide.

• MITRE ATT&CK: Phishing (T1566). Describes phishing as electronically delivered social engineering messages that may carry malicious attachments or links.
• CISA: Recognize and report phishing. Lists the common signs of phishing and how to report a message.