What Is Phishing?

What Is Phishing?

Phishing is a form of social engineering in which an attacker impersonates a trusted organization or person to lure a target into handing over credentials or sensitive data, sending money, or running malware. The lure most often arrives by email, and the same technique now runs over text messages, voice calls, QR codes, and social-media direct messages.

Spear phishing, whaling, and business email compromise are targeted forms of the same technique, and all of them persuade a person rather than exploit a software flaw.

How phishing works

A phishing attack combines a borrowed identity, a message that creates a reason to act, and a destination that captures what the target gives up. Attackers assemble those parts in sequence along the social engineering attack chain.

• Setup. Attackers harvest employee email addresses (opens in new tab) from open sources such as social media and company websites. That research shapes the pretext and the infrastructure: a lookalike domain close to the target's real one, a phishing kit installed on it, and a spoofed colleague or vendor sending identity.
• Contact, engagement, and compromise. The message pushes urgency, typically a password expiring, an invoice overdue, or an account about to lock. On a credential lure, the target types a username, password, and MFA code into a page that copies the real login. On a malware lure, the target opens an attachment, downloads a file, or pastes a command the page told them to run.

Why phishing is hard to stop

Phishing remains the dominant intrusion vector (opens in new tab), about 60% of observed intrusions in Europe when vishing, malspam, and malvertising are counted. It persists because it persuades rather than exploits: a pixel-perfect copy of a login page contains no malware for a scanner to find.

MFA no longer closes the gap. Adversary-in-the-middle kits (opens in new tab) such as Tycoon 2FA, which Europol and Microsoft disrupted in March 2026, proxy the real sign-in page and capture the session token after the victim completes MFA. Device-code phishing tricks the victim into entering a code that produces a device token (opens in new tab) for the attacker.

Phishing resistance (opens in new tab) is a property of the authentication protocol, one that holds "without reliance on the vigilance of the claimant."

Takedowns alone fall short too. Removing a phishing link leaves the hosted content online, and attackers point a new link (opens in new tab) at the same content. Some campaigns also leave the inbox entirely by pushing victims to a phone call outside email filtering.

Types of phishing

Phishing variants sort by target, channel, and technique:

• By target: Spear phishing tailors a message to one person or group with real details about them or their employer, and whaling aims it at senior executives (opens in new tab). Business email compromise (BEC) uses a legitimate or spoofed business email account to impersonate an executive, payroll contact, or supplier and trigger an unauthorized transfer of funds (opens in new tab).
• By channel: Smishing uses SMS or MMS (opens in new tab) text messages, and vishing uses voice calls that may include AI-generated voices. Quishing hides a malicious URL in a QR code, which moves the victim from a corporate endpoint to a mobile device.
• By technique: Clone phishing resends an email the target already received with a malicious link or attachment swapped in. Adversary-in-the-middle (AiTM) phishing places a reverse proxy between the user and the real site to steal credentials and the session cookie. Device-code and consent phishing abuse legitimate OAuth flows, so the victim enters a code or approves an app and the attacker receives the session. ClickFix shows a fake CAPTCHA or error prompt that convinces the user to paste a command (opens in new tab) into the Windows Run dialog or a terminal, which may help it bypass email filtering and browser sandboxing.

How to defend against phishing

Phishing defense has four layers (opens in new tab): make it difficult for attackers to reach users, help users identify and report, protect the organization from the effects of undetected phishing, and respond quickly to incidents. Each layer catches what the one before it missed, and some attacks will still get through.

• Deploy phishing-resistant MFA. FIDO/WebAuthn and PKI-based MFA are the gold standard (opens in new tab) because a fake login page cannot capture a usable credential. Where that is not yet possible, add number matching as an interim step, and block the device code flow wherever your organization does not need it.
• Move DMARC to reject. Set the policy to "reject" for sent email (opens in new tab) so receiving servers refuse messages that spoof your domain.
• Inspect inside the inbox. Email security that connects by API reads mail after delivery, including internal messages, where compromised accounts send the next wave. It runs alongside or in place of a gateway.
• Detect lookalike domains and take down the hosting. Under the amendments that took effect 5 April 2024 (opens in new tab), registrars must "promptly take appropriate mitigation action(s)" once they have actionable evidence that a domain they sponsor is used for phishing, so takedown requests need proof. Removing the page protects all targets; blocking it protects one.
• Train against live tactics and measure reporting. Run simulations that mimic current lures, and count reporters as well as clickers, since metrics that count only clicks teach staff to stay quiet. Add help-desk identity verification for credential resets and remote access instead of trusting caller ID.
• Triage each report. Determine whether the user clicked a link or opened an attachment, reset credentials, and review mailbox rules and newly registered MFA methods, since attackers can use both to keep access.

How Doppel helps

Doppel is the Agentic Social Engineering Defense (SED) platform unifying Digital Risk Protection (DRP) and Human Risk Management (HRM), with Email Security that connects to Microsoft 365 or Google Workspace by API, with no MX record changes or mail flow rewrites. AI agents assess each message against the attacker infrastructure mapped by the Doppel Threat Graph, including DNS registrations, certificates, and multi-channel indicators, which is how they catch AI-generated lures that inbox-only tools are not built to see.

Each detected or employee-reported phish becomes an automated investigation. The agents correlate it with Threat Graph infrastructure, then remediate or escalate, and they take down the sending infrastructure and malicious links behind confirmed phish so the same campaign cannot retarget the organization.

Phishing Triage works through the employee-reported queue in seconds, analysts keep the complex escalations, and every verdict traces back to a readable natural-language policy.

A 30-minute session shows how the platform traces a phish to its source and what the takedown returns, so your organization becomes too costly to attack.

Request a demo to get started.

Frequently asked questions about phishing

What is phishing?

Phishing is a scam in which an attacker poses as a trusted company or person to trick a target into revealing passwords or sensitive information, transferring money, or installing malware. Messages usually arrive by email and now also come by text, phone call, QR code, or social-media direct message. The term is a respelling of "fishing," (opens in new tab) and its first known use dates to 1996. Phishing relies on persuasion, so it can succeed even when systems have no technical vulnerability.

What is phishing in cybersecurity?

In cybersecurity, phishing is a category of social engineering, alongside pretexting, impersonation, and baiting. Defenders sort it by objective: stealing credentials or sensitive data, or delivering malware. The MITRE ATT&CK framework catalogs it as technique T1566 (opens in new tab), with sub-techniques for attachments, links, third-party services, and voice. Defenders therefore treat phishing as a human-targeted entry point for credential theft, fraud, and malware, not as a software flaw.

What is the difference between phishing and spear phishing?

Phishing in its broadest sense covers untargeted messages sent to many recipients, while spear phishing is built for one person or a small group from details about them or their employer. Whaling narrows the aim further to senior executives. All three use overlapping lures and payloads, and the difference is the research behind the targeting. Because a spear phishing message matches the target's real context, generic warning signs catch it less often.

What is an example of a phishing attack?

In September 2025, a developer who helps maintain widely used npm packages received an email, part of a larger campaign spoofing npm, saying he had to update his two-factor authentication credentials. The lookalike site mimicked npm's login page and intercepted his password and 2FA token (opens in new tab). The attackers then changed the email address on his account and pushed malicious code into at least 18 packages that were downloaded more than two billion times each week. The attack needed only a convincing page and an urgent deadline, not a software vulnerability.