Phishing attacks have become increasingly sophisticated and often transparently mirror the site being targeted, allowing the attacker to observe everything while the victim is navigating the site, and transverse any additional security boundaries with the victim. As of 2020, it is the most common type of cybercrime, with the FBI's Internet Crime Complaint Center reporting more incidents of phishing than any other type of computer crime.

The term "phishing" was first recorded in 1995 in the cracking toolkit AOHell, but may have been used earlier in the hacker magazine 2600. It is a variation of fishing and refers to the use of lures to "fish" for sensitive information.

Measures to prevent or reduce the impact of phishing attacks include legislation, user education, public awareness, and technical security measures. The importance of phishing awareness has increased in both personal and professional settings, with phishing attacks among businesses rising from 72% to 86% from 2017 to 2020.

Types of Phishing

Email Phishing

Phishing attacks, often delivered via email spam, attempt to trick individuals into giving away sensitive information or login credentials. Most attacks are "bulk attacks" that are not targeted and are instead sent in bulk to a wide audience. The goal of the attacker can vary, with common targets including financial institutions, email and cloud productivity providers, and streaming services. The stolen information or access may be used to steal money, install malware, or spear phish others within the target organization. Compromised streaming service accounts may also be sold on darknet markets.

This type of social engineering attack can involve sending fraudulent emails or messages that appear to be from a trusted source, such as a bank or government agency. These messages typically redirect to a fake login page where the user is prompted to enter login credentials.

Spear Phishing

Spear Phishing is a targeted phishing attack that uses personalized emails to trick a specific individual or organization into believing they are legitimate. It often utilizes personal information about the target to increase the chances of success. These attacks often target executives or those in financial departments with access to sensitive financial data and services. Accountancy and audit firms are particularly vulnerable to spear phishing due to the value of information their employees have access to.

Whaling and CEO Fraud

Whaling attacks use spear phishing techniques to target senior executives and other high-profile individuals with customized content, often related to a subpoena or customer complaint. 

CEO fraud involves sending fake emails from senior executives to trick employees into sending money to an offshore account. It has a low success rate but can result in organizations losing large sums of money.

Clone Phishing

Clone Phishing is a type of attack where a legitimate email with an attachment or link is copied and modified to contain malicious content. The modified email is then sent from a fake address made to look like it's from the original sender. The attack may appear to be a resend or update of the original email. It often relies on the sender or recipient being previously hacked so the attacker can access the legitimate email.

Voice Phishing

Voice over IP (VoIP) is used in vishing or voice phishing attacks, where attackers make automated phone calls to large numbers of people, often using text-to-speech synthesizers, claiming fraudulent activity on their accounts. The attackers spoof the calling phone number to appear as if it is coming from a legitimate bank or institution. The victim is then prompted to enter sensitive information or connected to a live person who uses social engineering tactics to obtain information. Vishing takes advantage of the public's lower awareness and trust in voice telephony compared to email phishing.

SMS Phishing

SMS Phishing or smishing is a type of phishing attack that uses text messages from a cell phone or smartphone to deliver a bait message. The victim is usually asked to click a link, call a phone number, or contact an email address provided by the attacker. They may then be asked to provide private information, such as login credentials for other websites. The difficulty in identifying illegitimate links can be compounded on mobile devices due to the limited display of URLs in mobile browsers. Smishing can be just as effective as email phishing, as many smartphones have fast internet connectivity. Smishing messages may also come from unusual phone numbers.

Page Hijacking

Page hijacking involves redirecting users to malicious websites or exploit kits through the compromise of legitimate web pages, often using cross-site scripting. Hackers may insert exploit kits such as MPack into compromised websites to exploit legitimate users visiting the server. Page hijacking can also involve the insertion of malicious inline frames, allowing exploit kits to load. This tactic is often used in conjunction with watering hole attacks on corporate targets.

Calendar Phishing

Calendar phishing involves sending fake calendar invites with phishing links. These invitations often mimic common event requests and can easily be added to calendars automatically. To protect against this form of fraud, former Google click fraud czar Shuman Ghosemajumder recommends changing calendar settings to not automatically add new invitations.

Quishing

QR codes have been used maliciously in phishing attacks. The term "quishing" involves deceiving individuals into thinking a QR code is harmless while the true intent is malicious, aiming to access sensitive information. Cybercriminals exploit the trust placed in QR codes, particularly on mobile phones, which are more vulnerable to attacks compared to desktop operating systems. Quishing attacks often involve sending QR codes via email, enticing users to scan them to verify accounts, leading to potential device compromise. It is advised to exercise caution and avoid scanning QR codes unless the source is verified.

Techniques used in Phishing

Link Manipulation

Phishing attacks often involve creating fake links that appear to be from a legitimate organization. These links may use misspelled URLs or subdomains to deceive the user. In the following example URL, HTTP://www.yourbank.example.com/ , it can appear to the untrained eyes as though the URL will take the user to the example section of the yourbank website; actually this URL points to the "yourbank" (i.e., phishing subdomain) section of the example website (fraudster's domain name). Another tactic is to make the displayed text for a link appear trustworthy, while the actual link goes to the phisher's site. To check the destination link, many email clients and web browsers will show the URL in the status bar when the mouse is hovering over it. However, some phishers may be able to bypass this security measure.

Internationalized Domain Names (IDNs) can be exploited via IDN spoofing or homograph attacks to allow attackers to create fake websites with visually identical addresses to legitimate ones. These attacks have been used by phishers to disguise malicious URLs using open URL redirectors on trusted websites. Even digital certificates, such as SSL, may not protect against these attacks as phishers can purchase valid certificates and alter content to mimic genuine websites or host phishing sites without SSL.

Phantom Domains

When publishing hyperlinks on websites, a programmer or contributor may accidentally mistype the intended URL. The link they create may, by chance, point to a never-registered domain. This creates a phantom domain, which is a never-registered domain with preexisting active inbound links from other websites. By analyzing the crawls of the web, an attacker can detect these hijackable hyperlinks and purchase the phantom domains they point to, spoofing the expected website to phish information from users. Research published at The Web Conference 2024, shows 52000 .com phantom domains exist with inbound links coming from a wide variety of sources, including large organizations and governments.

Filter Evasion

Phishers have sometimes used images instead of text to make it harder for anti-phishing filters to detect the text commonly used in phishing emails. In response, more sophisticated anti-phishing filters can recover hidden text in images using optical character recognition (OCR).

Social Engineering

Phishing often uses social engineering techniques to trick users into performing actions such as clicking a link opening an attachment, or revealing sensitive information. It usually involves pretending to be a trusted entity and creating a sense of urgency, like threatening to close or seize a victim's bank or insurance account.

An alternative technique to impersonation-based phishing is the use of fake news articles to trick victims into clicking on malicious links. These links often lead to fake websites that appear legitimate but are actually run by attackers who may try to install malware or present fake "virus" notifications to the victim.