What Is Phishing? How Attackers Steal Credentials

Phishing is a social engineering attack where criminals impersonate trusted entities to trick victims into revealing credentials, financial information, or downloading malware. It remains the most common initial attack vector in data breaches.

What Is Phishing?

Phishing is a type of social engineering attack where an attacker impersonates a trusted entity — a bank, a company, a colleague, or even a government agency — to deceive victims into revealing sensitive information, clicking malicious links, or downloading malware.

The name comes from "fishing" — attackers cast a wide net and wait for victims to take the bait.

Phishing is consistently the number one initial attack vector in data breaches worldwide. According to Verizon's annual DBIR report, over 80% of breaches involve a human element, and phishing is the leading cause.

How Phishing Works

1. Attacker crafts a convincing fake email (PayPal, HMRC, Microsoft)
2. Email contains a link to a fake login page or a malicious attachment
3. Victim believes the email is legitimate and clicks the link
4. Victim enters credentials on the fake page
5. Attacker captures credentials in real time
6. Attacker uses credentials to access the real account

Types of Phishing Attacks

1. Email Phishing (Bulk Phishing)

The most common form — mass emails sent to thousands of recipients impersonating well-known brands.

Signs of a phishing email:

  • Sender address does not match the brand (e.g. [email protected] vs [email protected])
  • Generic greeting ("Dear Customer" instead of your name)
  • Urgent language: "Your account will be suspended in 24 hours"
  • Suspicious links (hover to see the real URL before clicking)
  • Grammar and spelling errors

2. Spear Phishing

Highly targeted phishing aimed at a specific individual or organisation. The attacker researches the target in advance — their name, role, colleagues, and recent activities.

Generic phishing:  "Dear Customer, verify your account"
Spear phishing:    "Hi Sarah, following up on the invoice from Tuesday's
                   board meeting — please review: [malicious link]"

Much more convincing and harder to detect. Used in the majority of high-profile breaches.

3. Whaling

Spear phishing targeting senior executives (CEO, CFO, CISO). Also called CEO fraud.

  • Attackers impersonate boards, auditors, or regulators
  • Often used for business email compromise (BEC) to authorise fraudulent wire transfers
  • Example: A CFO receives an email "from the CEO" requesting an urgent £200,000 transfer

4. Vishing (Voice Phishing)

Phishing conducted over phone calls. Attackers impersonate banks, HMRC, Microsoft support, or police.

  • Creates urgency and fear to bypass critical thinking
  • Example: "This is HMRC. You owe £800 in unpaid taxes. Pay now to avoid arrest."

5. Smishing (SMS Phishing)

Phishing via text message (SMS), often impersonating parcel delivery services, banks, or the NHS.

  • Example: "Your parcel could not be delivered. Pay £1.50 rescheduling fee: [link]"
  • Links lead to fake payment pages that steal card details

6. Clone Phishing

The attacker creates a near-identical copy of a legitimate email previously received by the target, replacing links or attachments with malicious versions.

7. Pharming

Instead of deceiving the victim with a fake email, pharming redirects users from legitimate websites to malicious copies by poisoning DNS caches or modifying the HOSTS file.

Red Flags — How to Spot Phishing

| Warning Sign | Example | |-------------|---------| | Mismatched sender domain-kerberos-directory-services-explained) | [email protected] | | Urgency and threats | "Act within 2 hours or lose access" | | Unexpected requests | "Wire funds immediately — CEO request" | | Suspicious URLs | Hover shows http://paypal.fake-login.com | | Generic salutation | "Dear user" instead of your name | | Unexpected attachment | Invoice.pdf.exe | | Requests for credentials | Legitimate services never ask via email |

Real-World Phishing Examples

| Attack | Year | Impact | |--------|------|--------| | Sony Pictures hack | 2014 | Spear phishing gave hackers full network access; 100TB of data stolen | | Hillary Clinton campaign | 2016 | Spear phishing email compromised John Podesta's Gmail | | Twitter Bitcoin scam | 2020 | Vishing used to compromise Twitter employee accounts | | Microsoft 365 attacks | Ongoing | Millions of credential-harvesting pages impersonate M365 login |

How to Protect Against Phishing

For Individuals

  • Verify before you click — hover over links; type URLs manually
  • Enable MFA-explained) — even stolen credentials are useless without the second factor
  • Check the sender domain-kerberos-directory-services-explained) carefully — look for subtle substitutions
  • Never open unexpected attachments — call the sender to confirm
  • Use a password manager-explained)) — it will not auto-fill on fake phishing sites

For Organisations

  • Email filtering and anti-spam (Microsoft Defender, Proofpoint, Mimecast)
  • DMARC, DKIM, SPF — prevent attackers from spoofing your domain-kerberos-directory-services-explained)
  • security awareness training — regular phishing simulations
  • FIDO2-explained)-and-2fa-explained) / passkeys — phishing-resistant authentication (no password to steal)
  • incident response-security-operations-centre-SIEM-incident-response-explained) plan — clear process when phishing is reported

Quick Recap

  • Phishing deceives victims into revealing credentials or installing malware by impersonating trusted entities
  • Spear phishing is targeted at specific individuals; whaling targets executives
  • Vishing (calls) and smishing (SMS) are growing attack vectors
  • MFA-explained) is the single most effective control — it stops the majority of phishing-based account takeovers
  • DMARC + DKIM + SPF prevents attackers from spoofing your organisation's email domain-kerberos-directory-services-explained)