Cybersecurity glossary
What is Phishing?
Learn what phishing is, how attackers steal credentials and sessions with lookalike messages and sites, how it differs from BEC and spear phishing, and which technical and human controls reduce success.
Definition
Phishing is a social-engineering attack that uses deceptive messages—most often email, but also web, chat, or ads—to trick people into revealing secrets, installing malware, or completing a harmful action on an attacker-controlled destination that impersonates a trusted brand or colleague.
Why phishing remains the default initial access path
Phishing is still the cheapest way to borrow a user’s trust at internet scale. Criminals do not need a zero-day if they can convince someone to type a password, approve a prompt, or open a document. Tooling made this industrial: kits clone brand logins, bulletproof hosts rotate domains, and adversary-in-the-middle proxies steal sessions rather than just passwords.
The message is only half the attack. The other half is a destination that feels routine—a Microsoft 365 sign-in, a payroll portal, a shipping exception, a voicemail. Users are not failing a trivia test about padlocks. They are making a fast trust decision under a realistic work trigger.
That is why phishing is both a mail-filtering problem and an identity-architecture problem. You can block many lures. You still need authenticators that refuse to work on a lookalike origin.
Anatomy of a phishing attack
Choose a trusted brand or role
Impersonate a cloud suite, bank, parcel service, IT help desk, or a coworker whose name already appears in the inbox.
Craft a trigger
Use invoices, shared files, password expiry, missed calls, or HR tasks so the next click feels like work, not curiosity.
Deliver the lure
Send email, or shift to SMS, chat, ads, or QR codes when filters or user habits make email harder.
Land the victim
Open a cloned site, a malicious attachment, an OAuth consent screen, or a proxy that sits in front of the real service.
Capture the prize
Collect passwords, MFA codes, session cookies, mailbox access, or a foothold from the opened file.
Act before detection
Register inbox rules, raid files, pivot to payments, or sell the session while it is still valid.
What phishing is trying to obtain
Passwords and recovery paths
Classic kits collect username, password, and the answers needed to lock the victim out afterward.
Live sessions
AitM phishing relays the login and copies cookies so the attacker inherits an already-authenticated session.
OAuth grants
‘Grant access to this app’ screens can hand over mail or files without stealing the password at all.
Malware execution
Some campaigns skip the login page and use the message only to deliver a document, archive, or installer.
Phishing compared with nearby techniques
Keep the terms distinct so reporting and controls stay accurate.
| Term | Typical channel | Usual payload |
|---|---|---|
| Phishing | Email first, any message second | Lookalike site, attachment, or consent screen |
| Spear phishing | Personalized email to a chosen target | Same as phishing, with reconnaissance behind it |
| BEC | Business email impersonation | A payment or data instruction, often with no link |
| Pretexting | Any human conversation | A story that justifies the request |
Controls that reduce phishing success, not just inbox volume
- Authenticate your own mail with SPF, DKIM, and a rejecting DMARC policy so criminals cannot cheaply spoof your domain.
- Banner external senders, lookalike domains, and newly registered links; do not rely on users to parse raw URLs under time pressure.
- Prefer phishing-resistant MFA (passkeys, FIDO2) for email, VPN, and administrators. Treat SMS and TOTP as phishable.
- Restrict user consent to unverified OAuth apps and alert on risky grants, inbox rules, and impossible-travel sign-ins after a lure.
- Isolate or sandbox attachments and block unused document macros by default.
- Make reporting one click, reward reports, and measure time from first report to domain and session takedown.
- Simulate campaigns that match current kits—including AitM and QR lures—without shaming people who click.
- Assume a submitted login may have leaked a session: revoke refresh tokens, kill sessions, and check forwarding rules during response.
Why “check the URL” is no longer enough on its own
Homographs, mobile URL bars, redirected tracking links, and QR codes all shrink the chance that a hurried reader will see the real host. Reverse-proxy kits mean the page content can be the actual service, served through an attacker hostname. User education still matters—especially for unexpected requests—but identity binding and fast session revocation decide whether a click becomes an incident.
The practical takeaway
Phishing is deceptive communication plus a hostile destination. Commodity filters catch volume. Targeted and proxied campaigns steal sessions from people who did nothing more exotic than try to open a shared file.
Defend the message path, then defend the identity system so a lookalike origin cannot complete a login. When someone does click, treat session theft as the default hypothesis, not an afterthought.
Related security terms
Spear Phishing
A targeted phishing variant aimed at a specific person, role, or organization rather than a mass list.
Smishing
Phishing delivered over SMS or messaging apps that use phone numbers as the trust cue.
Vishing
Voice-channel phishing that uses phone calls and live pretext instead of a link.
Quishing
QR-code phishing that moves the malicious URL off the email body and onto a scanned code.
Business Email Compromise (BEC)
Payment-focused impersonation that often skips the fake login page phishing is known for.
Phishing-Resistant MFA
Authenticators that will not complete a login on an attacker’s lookalike origin.
Frequently asked questions
What is phishing in simple terms?
Phishing is a fake message that tries to make you do something unsafe—usually signing in on a lookalike site, opening a malicious file, or sending information—because it appears to come from a brand or person you trust.
Is every suspicious email phishing?
Phishing is the lure-and-destination pattern. Spam is unwanted bulk mail. BEC may impersonate a leader without a malicious link. Malware delivery can overlap with phishing when the attachment is the payload.
Why do phishing sites still work when we have HTTPS?
Attackers can obtain certificates for domains they own. A padlock means the browser has a valid cert for that host, not that the host is the real bank or software vendor.
What is adversary-in-the-middle phishing?
A reverse-proxy kit sits between the victim and the real site, stealing passwords and session cookies in real time—including many one-time codes—because the user completed a genuine-looking login.
Does MFA stop phishing?
SMS and TOTP help against reused-password stuffing but can be relayed in real time. Phishing-resistant MFA such as passkeys and FIDO security keys binds the login to the real origin.
What should employees do if they clicked?
Disconnect if possible, report the message immediately, change passwords from a known-good device, review MFA and forwarding rules, and assume session cookies may already be stolen if they submitted a login.
Can filters eliminate phishing?
No. Filters remove a large share of commodity mail, but lookalike domains, newly registered hosts, compromised mailboxes, and non-email channels still get through. Detection plus reporting plus strong authentication is the remaining layer.
References
Explore authoritative guidance and frameworks related to phishing.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.