What Is Pharming?

What Is Pharming?

Pharming is an attack that redirects a user to a fraudulent website by corrupting the process that translates a domain name into an IP address, either at a DNS server or on the subscriber's endpoint (opens in new tab). The user types the correct address and still lands on the attacker's page.

Pharming does not require the user to follow a link or respond to a message sent by email or text. The word combines "the term phishing" and "farming."

How pharming works

Across pharming variants, the attacker changes the answer a computer receives when it asks where a domain lives. The browser sends the legitimate hostname, gets back an IP address the attacker controls, and connects to it.

The address bar shows the correct URL because DNS returned exactly what it was asked for, and the browser has no built-in way to check whether that IP belongs to the domain's real owner.

Registrar or authoritative-record compromise removes even the padlock as a warning sign: an attacker who can set a domain's DNS records can also obtain valid certificates for it, so the browser shows no error warnings (opens in new tab).

That same access can power a padlocked login page that installs credential-stealing malware.

Why pharming is hard to stop

The misdirection happens after the computer sends its connection request, bypassing safeguards such as typing the address by hand or using a bookmark. Checking for HTTPS assumes the name-to-address translation is honest, and pharming breaks that assumption.

Conventional URL blocklists generally cannot detect this redirection because the domain in the request is the real one, and while APWG's eCrime eXchange, SURBL, and PhishTank all take phishing-URL reports, none run a pharming-specific list (opens in new tab).

A single poisoned resolver or hijacked router can redirect every user behind it, and state actors now run this at scale. Since at least August 2025, APT28 (Forest Blizzard, Russian military intelligence) has hijacked DNS settings on compromised consumer and small-office routers, in a campaign Lumen's Black Lotus Labs named FrostArmada (opens in new tab).

DHCP passed the altered settings to downstream devices (opens in new tab), so users inherited the rogue setting without changing their own configuration, and Microsoft observed the group redirecting Microsoft 365 logins through adversary-in-the-middle infrastructure (opens in new tab).

In April 2026 the FBI remotely reset the DNS settings on compromised routers under the court-authorized Operation Masquerade (opens in new tab).

Types of pharming attacks

Pharming splits into attacks on DNS infrastructure and attacks on the victim's own device, with router-based pharming operating at local-network scope.

The main pharming techniques include:

• DNS cache poisoning. The attacker forges answers into a recursive resolver's cache, and source port randomization now forces that attacker to guess more than one value. A poisoned resolver redirects users who rely on it without requiring malware on their machines.
• Authoritative record or registrar compromise. The attacker steals credentials at the registrar or DNS provider and edits the records through the legitimate management interface, so resolvers that query those authoritative records return the attacker's IP. An actor-controlled nameserver can then host a target's webmail hostname and intercept credentials.
• Malware-based (local) pharming. A trojan edits the hosts file, which the operating system consults before sending any DNS query. Trojan:Win32/Scar.C malware (opens in new tab) rewrites %windir%\system32\drivers\etc\hosts so search engine domains resolve to an attacker-controlled IP. The attack affects only the infected machine.
• Router-based and drive-by pharming. The attacker changes the DNS server setting on a router, and DHCP pushes that setting to connected devices that accept its configuration.

Drive-by pharming does the same from a web page whose JavaScript logs into the router with default credentials (opens in new tab).

How to defend against pharming

Defending all four vectors requires layered controls:

1. DNSSEC and encrypted DNS. DNSSEC provides origin authentication and is the best current practice (opens in new tab) (RFC 9364, BCP 237): forged answers fail signature validation, which stops cache poisoning, though it doesn't cover stolen registrar logins or hijacked routers. DNS over TLS (RFC 7858) and DNS over HTTPS encrypt the client-to-resolver path without authenticating the DNS data itself.
2. Phishing-resistant MFA and registrar lock. Require MFA, avoiding SMS-based factors (opens in new tab), on every account that can change DNS records, including third-party DNS panels and registrar logins, and confirm your registrar implements the Registrar-Lock control (opens in new tab) to specification. These controls secure the management plane that DNSSEC and encryption don't.
3. Certificate Transparency, CAA, and DNS monitoring. Monitor CT logs for certificates you did not request, restrict issuers with CAA records (RFC 8659), and compare DNS responses for your domains across resolvers and regions. Review resolver logs for unauthorized changes and anomalous answers, following applicable logging recommendations (opens in new tab).
4. Endpoint and router hygiene. Security software that flags hosts-file modifications covers managed devices.

Change the router's administrator password (opens in new tab) from the default.

How Doppel helps

Doppel is the Frontier AI Social Engineering Defense (SED) platform that unifies Digital Risk Protection (DRP) and Human Risk Management (HRM). It detects the DNS changes and lookalike infrastructure a pharming redirect sends victims to.

In the Doppel Threat Graph, it connects each spoofed destination to the fake profiles and scam ads running the same campaign, so teams see and dismantle it rather than isolated assets, and agentic AI executes automated takedowns through platform APIs.

Request a demo to see the connected campaign map and takedown workflow.

Frequently asked questions about pharming

What is pharming?

Pharming is a cyberattack that sends a user to a counterfeit website by tampering with the process that translates a domain name into an IP address. The tampering can happen in a DNS server's cache, in a domain's authoritative records, in a router's DNS settings, or in the hosts file on the victim's own device. Because the browser gets a false answer to a correct question, the address bar shows the real domain while the page belongs to the attacker. The name blends "phishing" and "farming."

Pharming vs. phishing: what is the difference?

Phishing is a social engineering attack: a deceptive email, text, or message persuades the target to click a link that leads to a lookalike site. Pharming corrupts DNS or the victim's device so a correctly typed address resolves to the attacker's server. A phishing victim sees a lookalike URL while a pharming victim sees the legitimate one. Pharming is less common than phishing because it demands far more work from the attacker, but a single poisoned resolver can redirect many users who depend on it.

What is an example of a pharming attack?

The Russian military intelligence actor APT28, also known as Forest Blizzard, ran a router DNS-hijacking campaign that Lumen's Black Lotus Labs named FrostArmada. Starting no later than August 2025, the group broke into vulnerable consumer and small-office routers and changed their DNS settings to point at attacker-controlled servers, which returned false addresses for Microsoft 365 login pages so the group could intercept credentials and authorization tokens. Devices that accepted router configuration through Dynamic Host Configuration Protocol (DHCP) inherited the rogue setting. In April 2026 the FBI, working with the Department of Justice and private-sector partners, remotely reset the DNS settings on compromised routers under a court-authorized disruption named Operation Masquerade (opens in new tab).