What is Phishing?
Phishing is the most common cyberattack faced by businesses and individuals alike. It uses social engineering tactics, such as deception or coercion, to induce the target to do what the attacker wants, such as handing over sensitive data or installing malware on their computer. Since phishing targets humans rather than software or systems, it is difficult to detect and requires awareness and multi-layer defenses to defend against.
Phishing attacks are the starting point for many types of attacks, including credential theft, financial fraud, ransomware infiltration, and data breaches. By masquerading as legitimate communications via email, SMS, phone, or social media, they slip past the target’s defenses to achieve the attacker’s goals.
This article breaks down the phishing threat, including how it works and the most common attack types. It also explores best practices that individuals and businesses can adopt to defend themselves against this common attack.
Understanding Phishing
Phishing is a type of social engineering attack, meaning that it targets humans rather than software flaws. Often, the goal is to reveal sensitive information, such as user credentials, but it can also be used to spread malware.
Email is the best-known delivery vector for phishing content, but attackers can use other mediums as well. Cybercriminals are increasingly using SMS, social media, and corporate SaaS apps to deliver malicious links or malware to an intended target.
Phishing is a ubiquitous threat, lying at the root of most data breaches. Cybercriminals use phishing to achieve various objectives, such as credential theft, financial gain, and malware distribution. For example, ransomware operators commonly use phishing to deliver their malware to a target environment.
Common Types of Phishing Attacks
Phishing attacks are a favorite technique for cyber threat actors since they are highly effective but require little technical knowledge to perform. Over time, cybercriminals have developed a range of different phishing techniques designed to take advantage of new technologies, bypass traditional security solutions, and enable an attacker to achieve their various goals. The table below details some of the most common forms of phishing attacks.
Email Phishing
Email phishing is commonly designed to trick users into clicking a malicious link or opening a malware-containing attachment. One common pretext is to pretend that something is wrong with a user’s account, directing them to a login page to fix the issue. However, the link sends them to a lookalike phishing site that harvests their credentials.
Spear Phishing
Spear phishing emails are more targeted than general phishing attacks, focusing on a particular individual or small group and using personalized information to make them look more credible. For example, an attacker might collect information from a user’s LinkedIn profile or a corporate website so that they can drop names or mention a particular project.
Smishing (SMS Phishing)
Smishing attacks send phishing content via SMS text messages. These attacks often take advantage of the fact that users are less suspicious of text messages and that it’s difficult to determine the target of a shortened URL in a text message.
Vishing (Voice Phishing)
Vishing attacks use the same social engineering techniques as phishing, but via a voice call rather than a written message. Often, attackers will impersonate customer support, IT staff, or a government employee to trick their target into providing sensitive information or allowing the attacker to remotely access their computer to install malware.
Whaling
Whaling attacks are spear-phishing attacks targeting high-profile individuals, such as an organization’s CEO or CFO. Since these individuals have significant power within an organization, they are a prime target for attacks designed to steal money from the business via fake deals or invoices. Additionally, a CEO deceived by the attacker may issue orders to employees to do as the attacker wishes.
Clone Phishing
Clone phishing attacks replicate legitimate emails to create versions with malicious links or infected attachments. These emails can be difficult to detect since their content is legitimate and realistic, except for the malicious elements introduced by the attacker.
Angler Phishing
Angler phishing attacks are designed to trick targets into coming to the attacker through the deceptive use of social media. For example, an attacker may pretend to be the customer service account for a popular brand and collect sensitive information from users under the guise of addressing their problems or concerns.
Quishing (QR Code Phishing)
Quishing attacks use QR codes to encode malicious links to phishing sites that collect login credentials or payment card data. These QR codes may be posted on signs at events or included in emails with the intent of having users scan them with personal devices that aren’t protected by corporate cybersecurity solutions.
How Phishing Works
Phishing attacks work by using deception and manipulation to get the target to do what the attacker wants. One of the most common techniques is introducing a sense of urgency to get the victim to believe that they need to act immediately, rather than thinking about whether or not the email is legitimate.
An attacker might accomplish this by indicating that something is wrong with a user’s account or that an (unauthorized) transaction has been approved. By making the target fearful or curious, the attacker increases the chance that they’ll click on a link or open and execute malware within an attachment.
In the case of phishing attacks with malicious links, the attacker will likely create a phishing page that mimics a trusted brand. When the user attempts to log into the site, the attacker can collect their credentials and use them to access the user’s real account.
Real-World Examples of Phishing Attacks
Phishing attacks can target organizations of any size and have significant business impacts. A couple of examples of high-profile phishing attacks include:
- Change Healthcare: In 2024, Change Healthcare, a subsidiary of UnitedHealth, suffered a data breach exposing medical data for about one-third of the U.S. population.
- Google and Facebook: Between 2013 and 2015, an attacker sent fake invoices to Google and Facebook, resulting in $100 million in losses.
Preventing and Mitigating Phishing Threats
Phishing attacks target people rather than technology, making awareness critical to a phishing prevention strategy. If a user knows common techniques and pretexts, they’re less likely to fall for the phish.
However, awareness training isn’t perfect, and it should be backed up by technical controls. Key elements of a phishing prevention strategy include email filtering, multi-factor authentication, and secure web gateways, as detailed in the table below.
Despite robust training and controls, it’s possible that an attack will slip through the cracks. For this reason, an organization should also have incident response plans in place to limit the potential damage to the organization.
Cato Networks’ Approach to Phishing Protection
Cato’s SASE framework integrates anti-phishing defenses to help organizations implement a multi-layer defense against this threat. Key elements include:
- Secure Web Gateway (SWG): Cloud-based SWG blocks browsing to known phishing pages, stopping users from entering credentials or downloading malware.
- Threat Intelligence: Threat intelligence sourced from Cato’s global network offers visibility into the latest phishing campaigns, including associated domains, IP addresses, pretexts, and malware.
- Traffic Inspection: Real-time inspection of network traffic allows phishing content to be identified and dropped before it reaches its intended destination.
FAQs about Phishing
How can I recognize a phishing email?
Phishing emails can be identified based on unfamiliar sender addresses, suspicious links, unusual and unexpected attachments, and language that is threatening or creates a sense of urgency.
What should I do if I suspect a phishing attempt?
If you suspect a phishing attempt, don’t click the links or download files, and delete the email. Report the message to your IT department so they can take action to mitigate the attack.
How does Cato Networks help protect against phishing?
Cato’s converged security platform incorporates secure web gateways (SWGs) and real-time traffic inspection to identify and block phishing content before it reaches the intended target.
Awareness and Action Matter
Phishing attacks are a top cybersecurity threat, and attackers are constantly refining their techniques to improve the success rates of their attacks. With phishing content growing more sophisticated, organizations need strong awareness training backed by multi-layer anti-phishing controls. See how the Cato SASE Cloud Platform neutralizes phishing threats before they reach your inbox by scheduling a personalized demo.