Phishing

Definition

Phishing is a type of cyberattack where someone **tricks you into giving away sensitive information** — like passwords, credit card numbers, or personal details — by pretending to be a trusted person or organization.

Attackers often use **email**, but phishing can happen through text messages (smishing), phone calls (vishing), or even fake websites. The goal is to make the bait look convincing so you “bite” without thinking.

A classic phishing email might:

* Pretend to be your bank, boss, or a popular service
* Use urgent language (“Your account will be locked!”)
* Include a link to a fake login page
* Attach a malicious file disguised as an invoice or form

Example:

```
From: support@micros0ft-secure.com
Subject: Urgent – Verify Your Account
Body: Click the link below to confirm your details immediately or your account will be suspended.
```

The link looks legit but actually leads to an attacker-controlled site designed to steal your login credentials.

In investigations, phishing is often the **first step** in a larger attack. Analysts look for signs like unusual sender addresses, mismatched URLs, and attachments with known malware hashes. Logs might show that a phishing link was clicked, followed by suspicious authentication attempts or file downloads.

Phishing is essentially **digital con artistry** — the attacker pretends to be someone you trust so you’ll hand over information, click a malicious link, or open an infected file. The “hook” is psychological manipulation: urgency, fear, curiosity, or greed.

Attackers love phishing because it works on *people*, not just systems. Even the most secure network can be breached if an employee clicks the wrong link. It’s low cost, high return, and can be easily automated — which is why it’s so common.

### Common Types of Phishing

* **Spear Phishing** – Targeted attacks aimed at a specific person or small group. The attacker uses personal details to make the message convincing. Example: An email to the CFO mentioning an upcoming board meeting and requesting a “wire transfer.”
* **Whaling** – A special type of spear phishing aimed at high-value targets (executives, senior officials).
* **Smishing** – Phishing via SMS. Often includes a shortened link to a fake site.
* **Vishing** – Phishing over the phone. The attacker pretends to be tech support, the IRS, or your bank.
* **Clone Phishing** – A legitimate email is copied, but its attachments or links are swapped for malicious ones.
* **Business Email Compromise (BEC)** – The attacker compromises or spoofs a legitimate business account to request sensitive info or payments.

### In an Investigation

When a phishing incident is suspected, analysts might:

1. **Check the Email Headers** – See the real sending server and compare to the claimed sender.
2. **Inspect URLs** – Look for misspellings, extra words, or strange TLDs (`secure-login-microsoft.net`).
3. **Sandbox Attachments** – Open suspicious files in a controlled environment to see if they run malware.
4. **Correlate Logs** – Did anyone click the link? Was there a spike in failed logins afterward?
5. **Pivot with Threat Intel** – Search the domain, IP, or file hash in threat intel platforms to see if it’s part of known campaigns.

Example investigative flow:

```
Suspicious Email Detected
        ↓
Extract Links & Attachments
        ↓
Compare Hashes / Domains to Threat Intel
        ↓
Trace User Actions After Click
        ↓
Block Malicious Domains and Contain Impact
```

**Additional Reading**

* **CISA – Phishing Guidance**
  [https://www.cisa.gov/resources-tools/resources/phishing-guidance](https://www.cisa.gov/resources-tools/resources/phishing-guidance)
  U.S. Cybersecurity & Infrastructure Security Agency’s overview of phishing tactics and prevention tips.

* **NCSC – Phishing: Guidance for Organisations**
  [https://www.ncsc.gov.uk/guidance/phishing](https://www.ncsc.gov.uk/guidance/phishing)
  UK National Cyber Security Centre’s advice for recognizing, preventing, and responding to phishing.

* **Google Security Blog – Phishing Trends**
  [https://security.googleblog.com/](https://security.googleblog.com/)
  Insights into how phishing evolves, with case studies from Google’s anti-abuse teams.

* **KnowBe4 Phishing Examples**
  [https://www.knowbe4.com/phishing](https://www.knowbe4.com/phishing)
  Realistic phishing email examples for training purposes.

* **MITRE ATT\&CK – Phishing Technique (T1566)**
  [https://attack.mitre.org/techniques/T1566/](https://attack.mitre.org/techniques/T1566/)
  Technical framework entry showing phishing variations, detection methods, and mitigations.

* **Proofpoint Quarterly Threat Reports**
  [https://www.proofpoint.com/us/resources/threat-reports](https://www.proofpoint.com/us/resources/threat-reports)
  Industry reports that often detail phishing campaigns and social engineering tactics.

Explore More Terms

Practice in These Games

A Scandal in Valdoria: A Political Mystery

A renowned newspaper, The Valdorian Times 🗞️, publishes an unauthorized article accusing the leading political candidate of corruption! But was it a hack, an insider, or something else? You'll inve...

View Game

Castle & Sand: A Beachy Case of Ransomware

In a world of sun, sand, and surf, Castle&Sand reigns supreme as the beacon of beachwear and accessories. Enter the **SharkzBoys**, a shadowy group of cyber marauders, who unleash a devastating ran...

View Game

HopsNStuff: An Easter APT hunt

HopsNStuff is a brewery renowned for crafting the most delectable ginger beer around. But what truly sets us apart is our secret formula, passed down from generation to generation. Learn how to wor...

View Game

Spooky Sweets: Sweet Sweet Pivots

The Spooky Sweets Candy Company is a renowned confectionery enterprise with a captivating history and a substantial global following. Founded in the early 20th century by the imaginative Wilhelmina...

View Game

A Rap Beef: An Intro to Security Investigations

Great for first time KC7 Players! You don't need any cybersecurity experience to do this module! 🥳 First time? This is the perfect place to start! Two hip-hop artists are in the midst of a musical ...

View Game

Solvi Systems: A tale of Supply Chains and ICS

Solvi Systems, a software company, is a key player is South Africa's energy industry ⚡. With its cutting-edge Docks software, Solvi Systems has become indispensable to major power and utility compa...

View Game

Titan Shield: A showcase of Microsoft Defender XDR

Welcome to TitanShield! TitanShield is a world-class defense company best known for manufacturing to keep the world safe 🦅 Recently, TitanShield has noticed some unusual activity on their network🧐....

View Game

AzureCrest - The full version

Azure Crest Hospital 🏥 is a cornerstone of healthcare excellence, standing tall as a regional medical beacon with a team of over 200 dedicated heroes. Azure Crest is more than a hospital—it's a lif...

View Game

A Rap Steak: A Tough Musical Affair

BBL Studios, a secretive powerhouse in the rap game, has brought in high-profile producer MetroBus Boomin to elevate their beats. However, the studio is now caught in the middle of a notorious rap ...

View Game