Phishing is a type of social engineering cyberattack where attackers trick victims into revealing sensitive information (passwords, credit card numbers, MFA codes, social security numbers) by pretending to be a trustworthy entity (bank, tech support, social media platform, employer). Phishing attacks are typically carried out via email (spoofed sender addresses), SMS (smishing), phone calls (vishing), or fake websites (domain typosquatting, homograph attacks). Phishing is the primary vector for credential theft, ransomware deployment, and business email compromise (BEC).
Attack Prevalence: 94% of malware is delivered via email (phishing). 80% of organizations experienced phishing attacks in 2023. 65% of data breaches involve phishing (Verizon DBIR). Average cost of a phishing attack: $4.5 million.
Common targets of phishing attacks:
Mass email campaigns sent to thousands of users. Generic branding ("Dear Customer"), urgent action required (account suspended, invoice attached). Fake links to credential harvesting sites.
Customized phishing emails targeting specific individuals or organizations. Uses personal information (name, job title, recent purchases, colleagues). Higher success rate than generic phishing.
Spear phishing targeting executives (CEO, CFO, CISO). Fake legal threats, subpoenas, or urgent wire transfer requests (Business Email Compromise).
Fake text messages (bank alerts, delivery notifications, security alerts). Malicious links to credential harvesting sites. SMS spoofing (fake sender ID).
Fake phone calls from "tech support", "IRS", "bank fraud department". Request remote access, credit card numbers, or social security numbers.
Attacker clones legitimate email (with real attachment/link), replaces with malicious version. Resends from spoofed address.
// Phishing email example (malicious link)
From: security@paypal.com (spoofed)
To: victim@example.com
Subject: Your account has been limited
Dear customer,
We noticed unusual activity on your PayPal account.
Please verify your account immediately:
https://paypal-security.xyz/login (malicious)
If you don't verify within 48 hours, your account will be suspended.
Sincerely,
PayPal Security Team
// Indicators of phishing (red flags):
- Sender email mismatch: spoofed@paypal.com vs legit @paypal.com
- Urgent/threatening language: "account suspended", "immediate action"
- Generic greeting: "Dear customer" (not personalized)
- Suspicious domain: paypal-security.xyz (not paypal.com)
- URL mismatch: hover reveals different destination
- Attachments: invoices.exe, document.docm (macros)
Phishing attack framework: website cloning (credential harvester), spear phishing email, mass mailer, malicious attachments (meterpreter reverse shell).
Phishing campaign management: email templates, landing pages, SMTP configuration, campaign tracking (open rates, click rates, credential capture).
Phishing proxy that captures MFA tokens (2FA bypass). Reverse proxy between victim and legitimate site. Steals session cookies (even after MFA).
This demonstration simulates a phishing email with fake login page capturing credentials:
This is a simulated demonstration. Real phishing can steal credentials, MFA tokens, and financial data. Protect yourself by verifying sender email addresses, hovering over links before clicking, using password managers (auto-fill only on legitimate domains), and enabling MFA (Multi-Factor Authentication). Report phishing to your IT security team.
Check sender's email domain (paypa1.com vs paypal.com). Verify SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) signatures. Email headers: Received-SPF: pass/fail.
Hover over links to reveal actual destination. Check for domain typosquatting (rnicrosoft.com, go0gle.com), URL shorteners (bit.ly, tinyurl), and homograph attacks (xn--80ak6aa92e.com).
"Your account will be suspended", "Immediate action required", "Legal action pending". Phishing creates false urgency to bypass rational thinking.
Implement SPF, DKIM, DMARC to prevent email spoofing. DMARC policy: p=reject (reject spoofed emails). Use email security gateways (Proofpoint, Mimecast, Microsoft Defender for Office 365).
MFA blocks credential theft even if password stolen. Use TOTP (Google Authenticator), hardware tokens (YubiKey), or push notifications (Duo).
Regular phishing simulations (KnowBe4, Proofpoint, Cofense). Train users to report phishing emails (Report Phish button). Quarterly refresher training.
Best Practice - MFA + DMARC + Training: Implement Multi-Factor Authentication (MFA) to prevent credential theft. Configure DMARC (p=reject) to prevent domain spoofing. Conduct regular phishing simulations and security awareness training (KnowBe4, Proofpoint). Use email filtering with SPF/DKIM/DMARC validation.
Phishing attacks (credential theft, identity fraud) are illegal in all jurisdictions:
Phishing attacks are illegal and unethical. Penalties include:
Important: This guide is for educational and defensive purposes only. Unauthorized phishing attacks are illegal.
Free phishing security test (PST) - simulate phishing attacks.
DMARC configuration and reporting tool.