Phishing

Phishing is a type of scam and social engineering attack in which tricksters get people to hand over private data or install harmful software like viruses, ransomware, or adware. It is the most common kind of cybercrime worldwide, and the danger has grown much worse because generative AI now lets attackers run very convincing, automatic, and highly targeted phishing campaigns on a scale never seen before. The word "phishing" first appeared in 1995 in the AOHell cracking toolkit, though it might have been used earlier in the hacker magazine *2600*. It comes from "fishing," referring to using bait to "fish" for sensitive details.

To stop or lessen the damage from phishing, people use laws, training, public awareness campaigns, and technical security tools. Awareness has become more important at home and at work. Among businesses, phishing attacks went from 72% in 2017 to 86% in 2020, and hit 94% in 2023. Phishing takes many forms: email spam, voice phishing (vishing), targeted phishing (spear phishing and whaling), SMS phishing (smishing), QR code phishing (quishing), cross-site scripting, and man-in-the-middle attacks on two-factor authentication.

Email phishing is the most common type. Attackers send bulk emails to a wide audience, pretending to be a trusted source like a bank or government agency. The messages lead to fake login pages where victims type in their credentials. The stolen info or access can be used to steal money, install malware, or spear phish others in the same organization. Compromised streaming accounts are sometimes sold on darknet markets.

Spear phishing is more effective because it targets specific people using personal or company details to seem believable. It often goes after executives or finance staff who handle sensitive data. Attackers may use email, SMS, and phone calls together to create urgency. Accounting and audit firms are especially at risk. In 2016, the Russian group Fancy Bear (GRU Unit 26165) targeted Hillary Clinton’s campaign with spear phishing on over 1,800 Google accounts using a fake domain. A study found that 43% of people aged 18–25 and 58% of older users clicked on simulated phishing links in daily emails over 21 days. Older women were the most likely to click, and while younger users got better over time, older users did not.

Voice phishing, or vishing, uses VoIP to make automated calls to many people, often with text-to-speech, claiming fake account activity. The caller ID is spoofed to look like a real bank. Victims are told to enter sensitive info or are connected to a live scammer. Vishing works because people trust phone calls more than email.

SMS phishing, or smishing, uses text messages with a link, phone number, or email address. The attacker may pretend to be a government officer, customer support, shipper, colleague, boss, or a wrong number. Smishing messages often come from unusual numbers, and mobile browsers make it hard to spot fake links. These scams rely on social engineering, like pretending to be a bank or customer service.

Page hijacking redirects users to malicious sites by breaking into legitimate web pages, often with cross-site scripting. Hackers may insert exploit kits like MPack into compromised sites to attack visitors. They can also add hidden inline frames that load exploit kits. This method is sometimes used with watering hole attacks on companies.

QR code phishing, or quishing, takes advantage of QR codes. Scammers embed a malicious website link in a code, and when victims scan it, they give up sensitive data.