Phishing and Spear Phishing

Phishing is a social engineering attack that uses deceptive emails, messages, or websites to trick targets into revealing credentials, installing malware, or transferring money.

It is the most common initial access vector in data breaches worldwide.

Effective phishing emails include:

• A spoofed or look-alike sender address
• Urgency ("Your account will be suspended")
• A malicious link pointing to a credential-harvesting site
• Branding and logos of trusted organizations
• Requests that bypass normal security thinking

Phishing variants:

• Email phishing — mass campaigns to many targets
• Spear phishing — targeted at specific individuals with personalized content
• Whaling — targets executives (CEOs, CFOs)
• Vishing — voice phishing via phone calls
• Smishing — SMS-based phishing

Spear phishing uses research about the target to increase credibility. Attackers gather information from LinkedIn, company websites, and social media to craft personalized messages that reference real colleagues, projects, or events.

BEC is a sophisticated spear phishing variant where attackers impersonate executives to authorize fraudulent wire transfers or reveal sensitive data. BEC attacks have cost organizations billions of dollars globally.

Attackers use:

• Lookalike domains (e.g., paypa1.com, microsoft-verify.net)
• Compromised legitimate servers to bypass reputation filters
• URL shorteners and redirects to hide final destinations
• Credential harvesting kits that clone login pages

Warning signs in emails:

• Sender address doesn't match display name
• Unexpected urgency or unusual requests
• Hover over links — destination doesn't match displayed text
• Generic greetings ("Dear Customer")
• Requests for credentials, payment, or sensitive data

Anti-spoofing mechanisms:

• SPF — authorizes which servers can send email for a domain
• DKIM — cryptographically signs emails from the domain
• DMARC — policy for what to do when SPF/DKIM fail (quarantine/reject)

Organizations without DMARC are trivially spoofable.

Organizations run phishing simulations to test employee awareness and train users to spot attacks. Employees who click simulated phishing links receive additional training. Simulation programs measurably reduce click rates over time.

When a phishing email is reported:

1. Block the sender and URL across all mailboxes
2. Identify all recipients
3. Check if anyone clicked or submitted credentials
4. Reset compromised accounts immediately
5. Preserve email headers for investigation

Defensive layers:

• Email gateway filtering (sandboxing attachments)
• DNS reputation checking
• Browser URL filtering and warning pages
• MFA — limits damage even if credentials are stolen
• Phishing-resistant MFA (FIDO2/hardware keys)

A targeted phishing email referencing a colleague by name and a specific internal project is called:

Phishing is the most common attack vector, using deceptive messages to steal credentials or install malware. Spear phishing uses research to personalize attacks. SPF, DKIM, and DMARC combat email spoofing. MFA and phishing-resistant credentials (FIDO2) limit the damage even when phishing succeeds.