What is Phishing?

Phishing remains the most common initial access vector for both opportunistic cybercrime and targeted APT campaigns because it attacks the human rather than the perimeter. Bulk phishing casts a wide net with generic lures, fake shipping notices, IRS warnings, password expiry alerts, relying on volume to catch a small percentage of clickers. Spearphishing narrows the target and personalizes the lure using details pulled from LinkedIn, company press releases, or breached data, so the email references a real project, vendor, or coworker name. Whaling targets executives and finance staff specifically because they can authorize large transfers or access sensitive systems. Vishing delivers the pretext over a phone call, often paired with caller ID spoofing, and smishing does the same over SMS, exploiting the fact that mobile users rarely scrutinize sender numbers.

The technical sophistication of phishing has grown well past a malicious attachment. Adversary-in-the-middle (AiTM) kits such as Evilginx sit as a reverse proxy between the victim and the real login page, relaying every field the victim types, including the MFA code, and capturing the resulting session cookie. That stolen cookie lets the attacker skip authentication entirely on replay, which is why MFA alone no longer stops a well-run phishing campaign. Business Email Compromise (BEC) skips malware altogether: the attacker compromises or spoofs an executive mailbox and sends a wire-transfer request with urgency and authority cues, leaving no link or attachment for a sandbox to detonate. QR-code phishing (quishing) embeds the malicious URL in an image specifically to evade text-based URL scanning in email gateways, betting the victim scans it with an unmonitored personal phone.

Defense combines technical and human controls. Email security gateways sandbox attachments and detonate embedded URLs in an isolated environment before delivery, and DMARC, DKIM, and SPF records let receiving servers verify that a message claiming to be from a domain actually originated from an authorized sending server, reducing domain spoofing. Browser isolation renders risky links in a remote container so any exploit never touches the endpoint. On the human side, simulated phishing exercises and a low-friction one-click reporting button turn the workforce into a detection sensor rather than the weakest link. Attackers exploit urgency, authority, and fear because those triggers short-circuit careful evaluation, which is exactly what awareness training is built to counter.