Phishing · Lablypedia

Common forms include general email phishing, targeted spear phishing and whaling, voice phishing (vishing), and SMS phishing (smishing). Other forms use QR codes or relay authentication through an adversary-in-the-middle.

Measures to prevent or reduce the impact of phishing attacks include legislation, user education, public awareness, and technical security measures.

Types

Email phishing

Phishing attacks, often delivered via email, attempt to trick individuals into giving away sensitive information or login credentials. General phishing is sent broadly, whereas spear phishing targets a particular person or group. The goal of the attacker can vary, with common targets including financial institutions, email and cloud productivity providers, and streaming services. The stolen information or access may be used to steal money, install malware, or spear phish others within the target organization. Compromised streaming service accounts may also be sold on darknet markets. Such attacks can involve messages that appear to be from a trusted source, such as a bank or government agency. The messages may redirect to a counterfeit login page that collects credentials.

Spear phishing

Spear phishing attacks can be more effective than general phishing attempts because they are tailored to specific individuals and use personal or organizational information to increase credibility. Whaling is a form of targeted phishing directed at senior decision-makers with access to valuable information. Automation can make personalized messages inexpensive enough to use at scale.

A field experiment sent simulated phishing emails to 100 younger and 58 older adults over 21 days. In this sample, 43% of participants clicked at least one simulated phishing link, and older women recorded the highest click rate among the four age-and-gender groups studied. Susceptibility declined among younger participants during the study but remained stable among older participants.

The Russian government-run Threat Group-4127 (Fancy Bear; GRU Unit 26165) used spear phishing against targets associated with Hillary Clinton's 2016 presidential campaign and the Democratic National Committee. SecureWorks linked the group to a separate 2015 campaign that targeted more than 1,800 Google accounts and used the spoofed domain accoounts-google.com.

Voice phishing (vishing)

Vishing, or voice phishing, uses telephone or Voice over IP calls to deliver the lure. Attackers may make automated calls, use text-to-speech, and claim that fraudulent activity has occurred on the recipient's account. They may spoof the caller number so that it appears to come from a bank or other institution. The victim is then prompted to enter sensitive information or connected to a person who uses social-engineering tactics to obtain it. A 2008 study found that voice phishing could exploit greater trust in voice telephony than in email.

SMS phishing (smishing)

Smishing is phishing delivered through SMS or MMS, often through an impersonating message, a malicious link, or a malware lure. The victim may be asked to click a link, call a phone number, or provide private information such as login credentials. The limited display of URLs on mobile devices can make illegitimate links harder to identify.

QR code phishing (quishing)

In "quishing" (QR code phishing), a code directs the person who scans it to a malicious website. Because QR codes conceal their destination in a form people cannot read directly, users may struggle to distinguish malicious codes from legitimate ones. Across three experiments with 1,876 participants, almost no participants identified QR-based phishing. Bogus codes may be sent by email or social media or printed on stickers placed over legitimate QR codes, such as those on car park notices. QR phishing can also be combined with a browser-in-the-browser lure to induce the victim to approve the attacker's two-factor access. The UK's National Cyber Security Centre assesses QR-code phishing as less common than other types of cyber fraud.

Adversary-in-the-middle phishing

In adversary-in-the-middle (AiTM) phishing, a victim interacts with an impostor site that relays the authentication exchange to the legitimate service in real time. Authentication methods that require a person to enter a one-time code are not phishing-resistant because the impostor can relay that code to the real verifier. Toolkits such as Evilginx automate this pattern by relaying credentials and a two-factor code while the victim is interacting with the phishing site. An authenticated web session is commonly maintained with a session cookie; possession of such a bearer secret can permit use of the session until it expires or is invalidated. Services that use short-lived session cookies restrict how long the captured session can be reused.

3 more chapters are free with a Lably account.

Techniques

Drive-by compromise and phishing

MITRE ATT&CK classifies drive-by compromise and phishing as separate initial-access techniques. In a drive-by compromise, attackers place malicious code on a website that a victim visits, for example by compromising a legitimate site or injecting scripts or inline frames. If the site is selected because it is frequented by a particular community or organization, the operation is commonly called a watering-hole attack. A phishing message can nevertheless link to a website used for drive-by compromise, so the two techniques can occur in the same campaign.

Link manipulation

Phishing links may use misspelled registered domains or deceptive subdomains to conceal their destination. In the example http://www.yourbank.example.com/, the registered domain is example.com, while yourbank is only a subdomain. Another tactic is to make the link's displayed text appear trustworthy while the link itself leads to the phisher's site.

Internationalized domain names (IDNs) can be exploited via IDN spoofing or homograph attacks to allow attackers to create fake websites with visually identical addresses to legitimate ones. Separately, phishers have used open URL redirectors on trusted websites to disguise malicious destinations. In http://www.exаmple.com/, for example, the third character is not the Latin letter 'a' but the Cyrillic character 'а'. A person who follows that link visits the malicious site http://www.xn--exmple-4nf.com/.

Phishing often uses social engineering techniques to trick users into performing actions such as clicking a link, opening an attachment, or revealing sensitive information. It often involves impersonating a trusted entity and creating a sense of urgency, like threatening to close or seize a victim's bank or insurance account. Phishing attacks may rely on spoofing an organization's website to trick victims into entering credentials.

Generative AI can make phishing and other social-engineering content more convincing by producing realistic text and images. It can also reduce the effort needed to personalize and automate attacks.

In a 2026 experiment with 7,700 participants, LLM-personalized emails produced almost three times the click rate of generic phishing emails, at an estimated cost of about US$0.03 per message.

History

Early history

Phishing was documented on AOL in 1995, and the term appeared in print by March 1997. Its spelling is generally linked to the earlier term "phreaking". AOHell, released in 1994, allowed users to impersonate AOL staff and send instant messages asking victims to reveal their passwords.

2000s

In the 2000s, phishing attacks became more organized and targeted. The first known direct attempt against a payment system, E-gold, occurred in June 2001, and shortly after the September 11 attacks, a "post-9/11 id check" phishing attack followed. The first known phishing attack against a retail bank was reported in September 2003. Between May 2004 and May 2005, approximately 1.2 million computer users in the United States suffered losses caused by phishing, totaling approximately US$929 million. Phishing was recognized as a fully organized part of the black market, and specializations emerged on a global scale that provided phishing software for payment, which was assembled and used in phishing campaigns by organized gangs. The United Kingdom banking sector suffered from phishing attacks, with losses from web banking fraud almost doubling in 2005 compared to 2004. In 2006, almost half of phishing thefts were committed by groups operating through the Russian Business Network based in St. Petersburg. Email scams posing as the Internal Revenue Service were also used to steal sensitive data from U.S. taxpayers. A phishing campaign targeted Myspace users in 2006. In 2007, 3.6 million adults lost US$3.2 billion due to phishing attacks. The Anti-Phishing Working Group reported receiving 115,370 phishing email reports from consumers, with the US and China each hosting more than 25% of the phishing pages in the third quarter of 2009.

2010s

In 2011, information related to RSA SecurID security tokens was stolen through a phishing attack. Chinese phishing campaigns also targeted high-ranking officials in the US and South Korean governments and military, as well as Chinese political activists.

In August 2013, Outbrain suffered a spear-phishing attack, and in November 2013, 110 million customer and credit card records were stolen from Target customers through a phished subcontractor account. Subsequently, the CEO and IT security staff were dismissed.

In August 2014, iCloud leaks of celebrity photos were based on phishing e-mails that were sent to victims and looked like they came from Apple or Google. In November 2014, phishing attacks on ICANN gave attackers administrative access to the Centralized Zone Data System, as well as data about users in the system and access to ICANN's public Governmental Advisory Committee wiki, blog, and whois information portal.

Fancy Bear was linked to spear-phishing attacks against the Pentagon email system in August 2015, and the group used a zero-day exploit in Java in a spear-phishing attack on the White House and NATO. Fancy Bear carried out spear phishing attacks on email addresses associated with the Democratic National Committee in the first quarter of 2016.

In August 2016, members of the Bundestag and political parties such as Linken-faction leader Sahra Wagenknecht, Junge Union, and the CDU of Saarland were targeted by spear-phishing attacks suspected to be carried out by Fancy Bear. In August 2016, the World Anti-Doping Agency reported receiving phishing emails that were sent to users of its database and claimed to be official WADA communications, but were consistent with the Russian hacking group Fancy Bear.

Qatar recorded 93,570 phishing attacks in the first quarter of 2017. In August 2017, customers of Amazon faced the Amazon Prime Day phishing attack, when hackers sent out seemingly legitimate deals to customers of Amazon. When Amazon's customers attempted to make purchases using the "deals", the transaction would not be completed, prompting the retailer's customers to input data that could be compromised and stolen. In 2018, the company block.one, which developed the EOS.IO blockchain, was attacked by a phishing group who sent all customers phishing emails aimed at intercepting users' cryptocurrency wallet keys, and a later attack targeted airdrop tokens.

2020s

The July 15, 2020, Twitter breach combined a counterfeit internal-service login page with telephone social engineering. A 17-year-old hacker and accomplices set up a fake website resembling Twitter's internal VPN provider used by remote working employees. Posing as helpdesk staff, they called multiple Twitter employees, directing them to submit their credentials to the fake VPN website. Using the details supplied by the unsuspecting employees, they were able to seize control of several high-profile user accounts, including those of Barack Obama, Elon Musk, Joe Biden, and Apple Inc.'s company account. The hackers then sent messages to Twitter followers soliciting Bitcoin, promising to double the transaction value in return. The hackers collected 12.86 BTC (about $117,000 at the time).

An analysis of 4,875 reported incidents affecting the European threat landscape from July 2024 through June 2025 found that phishing accounted for about 60% of observed initial-access cases. Phishing-as-a-service platforms automate branded phishing kits by cloning login pages and distributing links through templated infrastructure, lowering the skill needed to run a campaign. ENISA reported that the Darcula platform had impersonated more than 200 organizations and targeted users in more than 100 countries.

Anti-phishing

Anti-phishing programs combine measures at the training, mail, browser, network, authentication, and incident-response layers.

User training

Organizations commonly use simulated-phishing exercises that show training material after a recipient interacts with a test message. One 2024 field study of a partner company's employees found that, in that setting, the measured benefit of embedded training came mainly from the periodic reminder created by the exercise rather than from material shown after a click; employees often did not consume that material, and mandatory completion did not improve secure behavior.

Technical approaches

Modern technical defenses use overlapping controls rather than relying on a single filter or authentication step.

Mail filtering and sender authentication

Mail systems use content and reputation filtering alongside standards that authenticate sending domains. Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) provide domain-level authentication, while DMARC checks whether a passing SPF or DKIM identifier aligns with the author domain shown in the message's From field and lets a domain owner publish handling and reporting policies. DMARC addresses only some forms of exact-domain spoofing: it does not validate display names, visually similar domains, or message content, and a DMARC pass does not establish that a message is safe. In a 2021 experiment covering 30 popular mail services and 23 email clients, every tested service or client was vulnerable to at least one newly identified sender-spoofing technique that exploited inconsistencies in the authentication chain.

Browser and network blocking

Major desktop and mobile browsers display warnings for destinations on anti-phishing blocklists, sometimes supplemented by heuristic classifiers. These systems are reactive, so there can be a gap between a site's deployment and its addition to a list, and evasive sites may avoid prompt classification. At the network level, protective DNS can refuse to resolve domains identified by phishing threat feeds and can log matching queries, adding an enforcement layer that does not depend on features in each client.

Phishing-resistant authentication and session protection

Multi-factor authentication can limit the value of a stolen password, but not every second factor resists phishing. NIST does not classify manually entered one-time passwords or out-of-band codes as phishing-resistant because an impostor verifier can relay the value to the real service. WebAuthn instead binds a cryptographic response to the authenticated relying-party domain; when correctly implemented, syncable WebAuthn authenticators, commonly called passkeys, can provide phishing resistance.

An adversary-in-the-middle proxy can relay a password and a manually entered one-time code during a live login. Authentication may then create a browser session maintained by a cookie used as a bearer secret; possession of that secret, rather than repeated entry of the user's authenticators, maintains the session. Phishing-resistant sign-in should therefore be paired with controls for the session and its tokens. NIST recommends short, defined lifetimes for identity and access tokens, revocation and audience restrictions, session monitoring, and sender-constrained or proof-of-possession tokens where feasible.

Detection, reporting and takedown

Reports from users and automated detection systems can feed newly discovered URLs to anti-phishing blocklists. Operators may also ask a hosting provider or domain registrar to disable the infrastructure, but takedown depends on cooperation and may take hours or days; blocklisting can act sooner, although it has its own coverage and latency gaps. A response can therefore combine rapid reporting and blocking with token revocation after a compromise and, where possible, infrastructure takedown.

Legal responses

Phishing is usually addressed through laws covering the conduct involved rather than through a single offense. In the United States, the Computer Fraud and Abuse Act applies to specified forms of unauthorized computer access, while other federal provisions may apply to wire fraud, access-device fraud, and aggravated identity theft, depending on the facts.

In the European Union, Directive (EU) 2019/713 requires member states to criminalize specified conduct involving non-cash payment instruments; its recitals identify phishing and redirection to imitation websites as ways of obtaining payment instruments for fraud. In England and Wales, prosecution guidance treats phishing as a form of cyber-enabled fraud and points prosecutors to the Fraud Act 2006, the Computer Misuse Act 1990, and related legislation, with the charge determined by the conduct.

Because phishing campaigns, infrastructure, victims, and evidence can be spread across several countries, enforcement also relies on international cooperation. The Budapest Convention combines common offense categories with powers for obtaining electronic evidence and mechanisms for cooperation among its parties. As of 20 September 2026, the United Nations Convention against Cybercrime had 82 signatories and three parties but was not yet in force; under Article 65, it will enter into force 90 days after the fortieth ratification, acceptance, approval, or accession.