Also known as: phishing attack · credential phishing
Phishing is a social-engineering attack in which an adversary impersonates a trusted party — typically via email, SMS, or a cloned website — to trick a victim into revealing credentials, authorising a payment, or installing malware.
Phishing persists because it targets people rather than software, and people cannot be patched. Modern campaigns are far more sophisticated than the misspelled bank emails of a decade ago: convincing domain lookalikes, real-time proxying of login pages, and interception of one-time passcodes as the victim enters them.
Variants are distinguished mainly by targeting and channel. Spear phishing is tailored to a specific individual using researched detail; whaling targets executives; smishing and vishing use SMS and voice calls respectively.
Phishing-as-a-Service
Phishing-as-a-service (PhaaS) is a subscription model in which criminal platforms sell ready-made phishing kits, hosting, and credential-capture infrastructure to customers who lack the skill to build them.
Social Engineering
Social engineering is the manipulation of people into performing actions or disclosing information that compromises security, exploiting trust, authority, urgency, or helpfulness rather than technical vulnerabilities.
Multi-Factor Authentication
Multi-factor authentication (MFA) requires two or more independent categories of evidence to verify identity — typically something you know, something you have, and something you are — so that a stolen password alone is insufficient to gain access.
Credential Stuffing
Credential stuffing is an automated attack that takes username and password pairs leaked from one breach and tries them en masse against other services, exploiting the fact that many people reuse the same password across sites.
Business Email Compromise
Business email compromise (BEC) is a fraud in which an attacker impersonates or hijacks a trusted business email account to induce fraudulent payments or data disclosure, typically without deploying any malware.