GO KALI FREE
BeginnerSecurity

Phishing Attacks: Recognition, Prevention, and Response

Learn to recognize and defend against phishing attacks including email phishing, spear phishing, smishing, vishing, and advanced social engineering techniques.

#phishing#social engineering#email security#cyber awareness#SPF#DMARC

The $100 Million Email That Changed Security

Between 2013 and 2015, a Lithuanian man impersonated a hardware vendor and sent fake invoices to Google and Facebook. The companies paid over $100 million into the attacker's bank accounts before discovering the fraud. This Business Email Compromise (BEC) attack succeeded not through technical exploits but through a simple phishing email — and it remains one of the costliest social engineering attacks in history.

Phishing is a social engineering attack where attackers impersonate legitimate organizations or individuals to trick victims into revealing sensitive information or installing malware. It is the most common cyber attack vector, involved in over 90% of data breaches.

Prerequisites

No technical background required. Basic familiarity with email and messaging is sufficient.

Types of Phishing

Email Phishing

Mass emails sent to thousands of recipients, impersonating banks, tech companies, or government agencies. Characterized by generic greetings ("Dear Customer"), poor grammar, spoofed sender addresses, and urgent calls to action.

Spear Phishing

Targeted attacks aimed at specific individuals or organizations. Attackers research their targets using OSINT (LinkedIn, company websites, social media) to craft highly personalized messages. May reference real projects, colleagues, or recent events to appear legitimate.

Whaling

Spear phishing targeting senior executives (CEOs, CFOs, CTOs). Messages are carefully crafted based on publicly available information about the executive's role, responsibilities, and travel plans. A single compromised executive account can provide access to financial systems, contracts, and sensitive data.

Smishing (SMS Phishing)

Phishing via SMS text messages. Attackers send texts pretending to be banks, delivery services, or healthcare providers. Smishing exploits the higher trust associated with text messages and the smaller screen (easier to hide suspicious details).

Vishing (Voice Phishing)

Phishing via phone calls. Attackers use caller ID spoofing to appear as legitimate organizations. Vishing attacks often create high-pressure situations: "Your computer has a virus!" or "Your account has been compromised — give me remote access now!"

Clone Phishing

Attackers create a nearly identical copy of a legitimate previously delivered email. The cloned email replaces legitimate links with malicious ones. The victim trusts the email because they have seen similar messages before.

Business Email Compromise (BEC)

Attackers impersonate executives or vendors to trick employees into making fraudulent wire transfers or sharing sensitive data. BEC attacks are highly targeted and result in the highest financial losses per incident — over $50 billion in total losses since 2013.

Anatomy of a Phishing Email

From: "security@amaz0n.com" (spoofed)
To: victim@company.com
Subject: URGENT: Your Account Has Been Suspended

Dear Customer,

Your Amazon account has been suspended due to
unusual activity. To restore access, verify your
account immediately:

[Click Here to Verify]  <-- links to fake.amazon-login.com

Failure to verify within 24 hours will result in
permanent account closure.

Thank you,
Amazon Security Team

Red flags: spoofed domain (amaz0n.com), generic greeting, urgent threat, mismatched link URL, poor grammar.

How Phishing Attacks Work

Reconnaissance

Attackers gather information about targets through OSINT: company websites, LinkedIn, social media, data breaches, and public records. This informs the content and personalization of the attack.

Attack Delivery

Phishing messages are delivered via email, SMS, social media, messaging apps, or phone calls. Attackers may use compromised accounts to send messages that appear trusted.

Exploitation

When the victim clicks the link, they are taken to a fake login page that captures credentials, or the visit downloads malware (banking trojan, ransomware, keylogger).

Exfiltration

Stolen credentials are used to access real accounts. Data is exfiltrated. The compromised account may be used to send further phishing messages to the victim's contacts.

Technical Defenses

Email Authentication

SPF (Sender Policy Framework): Specifies which servers are authorized to send email for a domain. Prevents spoofing.

DKIM (DomainKeys Identified Mail): Cryptographically signs emails so recipients can verify they came from the claimed domain.

DMARC (Domain-based Message Authentication, Reporting & Conformance): Tells email servers how to handle messages that fail SPF/DKIM checks (quarantine or reject).

# Check SPF record
nslookup -type=TXT example.com | grep "v=spf1"
# Output: "v=spf1 include:_spf.google.com ~all"

Email Filtering

Advanced spam filters analyze email content, sender reputation, links, attachments, and behavioral patterns to detect phishing before it reaches users.

Web Filtering

Blocks access to known malicious domains. URL scanning services (Google Safe Browsing, VirusTotal) identify malicious websites.

Multi-Factor Authentication

MFA prevents credential theft from being sufficient for account access. Even if a user enters their password on a fake page, the attacker cannot authenticate without the second factor.

User Awareness

Recognizing Phishing

  • Check the actual sender email address, not just the display name
  • Hover over links to see the real URL before clicking
  • Look for generic greetings ("Dear Customer" instead of your name)
  • Be suspicious of urgent threats or unbelievable offers
  • Verify unusual requests through a separate communication channel

    • What to Do When You Suspect Phishing

  • Do not click any links or download attachments
  • Report the message to your security team or IT department
  • If you clicked a link, change passwords immediately
  • Enable MFA on affected accounts
  • Monitor accounts for suspicious activity

    • Real-World Examples

    Google/Facebook $100M Fraud (2013-2015): A Lithuanian man impersonated a hardware vendor, sending fake invoices to Google and Facebook. The companies paid over $100 million to the attacker's bank accounts before discovering the fraud.

    Colonial Pipeline Ransomware (2021): Attackers gained access through an old VPN account without MFA. The account was discovered in a leaked password database. The resulting ransomware attack shut down fuel pipelines across the US East Coast.

    Twitter Bitcoin Scam (2020): Attackers used social engineering to access Twitter's internal admin tools. They posted a cryptocurrency scam from verified accounts including Elon Musk, Barack Obama, and Bill Gates, stealing over $100,000 in Bitcoin.

    Common Mistakes

    Clicking links without verifying the URL. Entering credentials on pages reached from email links. Assuming internal emails are always safe. Bypassing security warnings because of urgency. Not reporting suspicious messages.

    Best Practices

    Implement DMARC, SPF, and DKIM for your domains. Deploy advanced email filtering. Enable MFA on all accounts. Conduct regular phishing simulation training. Establish clear reporting procedures. Create a culture where reporting phishing is encouraged, not punished. Keep software updated to prevent exploits.

    Related Tools

    Gophish — Open-source phishing simulation platform. SPF/DKIM/DMARC validators — Check domain email security. PhishTank — Community phishing database. Have I Been Pwned — Check if accounts were breached. VirusTotal — Scan URLs and attachments.

    Related Articles

  • social-engineering-awareness
  • security-awareness
  • mfa-explained
  • password-security-guide
  • threat-actors

    • Summary

    Phishing is the most common cyber attack vector, exploiting human psychology through deceptive emails, texts, and calls. Types include email phishing, spear phishing, whaling, smishing, vishing, and BEC. Defenses combine technical controls (SPF/DKIM/DMARC, email filtering, MFA) with user awareness and reporting procedures. Recognizing red flags and verifying requests through separate channels are the most effective individual defenses.

    Knowledge Check

  • What is the difference between phishing and spear phishing?
  • What is Business Email Compromise (BEC)?
  • How do SPF, DKIM, and DMARC help prevent phishing?
  • What should you do when you suspect a phishing email?
  • Why is MFA effective against credential phishing?

    • Frequently Asked Questions

    What is phishing?

    Phishing is a social engineering attack where attackers impersonate legitimate organizations to trick victims into revealing sensitive information or installing malware. It is the most common cyber attack vector, involved in over 90% of data breaches. Phishing exploits human psychology — trust, fear, urgency, and curiosity — rather than technical vulnerabilities.

    What is the difference between phishing and spear phishing?

    Phishing is a mass attack targeting thousands with generic messages. Spear phishing is targeted, aimed at specific individuals or organizations. Attackers research their targets using OSINT (LinkedIn, social media) to craft personalized messages referencing real projects or colleagues. Spear phishing has a much higher success rate than generic phishing.

    What is Business Email Compromise (BEC)?

    BEC attacks impersonate executives or vendors to trick employees into making fraudulent wire transfers or sharing sensitive data. BEC is highly targeted and results in the highest financial losses per incident — over $50 billion in total losses since 2013. The Google/Facebook $100M fraud case is a notable example.

    How do SPF, DKIM, and DMARC help prevent phishing?

    SPF specifies which servers can send email for a domain, preventing spoofing. DKIM cryptographically signs emails so recipients can verify they came from the claimed domain. DMARC tells email servers how to handle messages that fail SPF/DKIM checks (quarantine or reject). Together, they significantly reduce email spoofing. Check your domain's records with `nslookup -type=TXT example.com`.

    What should you do when you suspect a phishing email?

    Do not click any links or download attachments. Report the message to your security team or IT department. If you clicked a link, change passwords immediately and enable MFA on affected accounts. Monitor accounts for suspicious activity. Never forward the phishing email to colleagues — this can spread the attack.

    Why is MFA effective against credential phishing?

    MFA requires a second factor (phone, hardware key, biometric) beyond the password. Even if a user enters their password on a fake login page, the attacker cannot authenticate without the second factor. Hardware security keys (YubiKey) are particularly effective because they verify the domain before authenticating, preventing real-time phishing.

    What is smishing and vishing?

    Smishing is phishing via SMS text messages, often impersonating banks, delivery services, or healthcare providers. Vishing is phishing via phone calls, using caller ID spoofing to appear legitimate. Both exploit the higher trust associated with these channels. Smaller screens (SMS) make it harder to spot suspicious details like mismatched URLs.

    How do I check if an email is a phishing attempt?

    Check the actual sender email address (not just the display name), hover over links to see the real URL before clicking, look for generic greetings like 'Dear Customer', be suspicious of urgent threats or unbelievable offers, and verify unusual requests through a separate communication channel like a phone call.

    What are the red flags of a phishing email?

    Red flags include: spoofed or misspelled domains (amaz0n.com), generic greetings, urgent threats ('act now or lose your account'), mismatched link URLs, poor grammar and spelling, unexpected attachments, and requests for credentials or personal information. Legitimate organizations rarely ask for sensitive data via email.

    How does phishing differ from other social engineering?

    Phishing is a subset of social engineering delivered via electronic messages (email, SMS). Other social engineering forms include pretexting (phone calls with a fabricated scenario), baiting (infected USB drives left in public), tailgating (following someone into a secure area), and quid pro quo (offering a service in exchange for information). See our [Security Awareness](/articles/security-awareness) article for comprehensive coverage.

    How effective are phishing simulation training programs?

    Phishing simulations significantly reduce click rates over time when combined with immediate feedback and positive reinforcement. A financial institution reduced click rates from 25% to 3% over 18 months. The key is testing, not punishing — employees who fall for simulations should receive constructive training, not discipline. See our [Security Awareness](/articles/security-awareness) guide for building effective programs.

    What is clone phishing?

    Clone phishing creates a nearly identical copy of a legitimate previously delivered email, replacing legitimate links with malicious ones. The victim trusts the email because they have seen similar messages before. Clone phishing is particularly effective because it bypasses the recipient's initial skepticism about unfamiliar senders.