What is Phishing?
Phishing is a social engineering attack in which a threat actor sends fraudulent messages, usually by email, to trick recipients into revealing credentials, transferring money, or running malware. It is one of the most common entry points for data breaches and ransomware incidents.
What it is
Phishing is a deception technique, not a piece of software. An attacker crafts a message that appears to come from a trusted source: a bank, a colleague, a cloud service, or an executive. The message asks the recipient to click a link, open an attachment, or reply with sensitive information.
Common phishing variants include:
- Spear phishing: targeted at a specific person, using personal details to appear credible.
- Whaling: spear phishing aimed at executives or high-value targets.
- Smishing: phishing delivered by SMS.
- Vishing: phishing delivered by voice call.
- Clone phishing: a copy of a legitimate email with a malicious link or attachment swapped in.
The goal is almost always one of three things: steal credentials, install malware, or initiate a fraudulent financial transfer.
Why it matters
Phishing succeeds because it targets people, not systems. A technically sound network perimeter offers no protection when an employee types their password into a fake login page. According to industry breach reports, phishing is consistently among the top three initial access methods used in confirmed breaches. A single successful phish can give an attacker a foothold to move laterally, escalate privileges, and exfiltrate data.
How tools address it
Anti-phishing tools work at several points in the attack chain:
- Email filtering: scanning inbound messages for malicious links, spoofed sender domains, and suspicious attachments before delivery.
- Point-of-click protection: browser extensions or DNS-layer controls that block a malicious URL at the moment a user clicks it, even if the link was clean at delivery time.