Social engineering

Phishing

Phishing campaigns use convincing messages to trick people into giving up access, information or money. They range from mass emails to highly targeted messages written for one person.

Motivation: Stolen credentials, malware delivery or fraudulent payments, depending on the campaign.

Overview

Phishing is the practice of sending messages that pretend to be someone or something trusted, in order to get the recipient to do something that helps the attacker. The message may be an email, a text, a phone call or a chat message. It works because it targets people, not software.

Some campaigns are broad and low-effort, sent to thousands of people in the hope that a few will act. Others are targeted, using real names, roles and projects found in public sources to write something that looks entirely normal. The most damaging targeted form is business email compromise, where there may be no link or attachment at all, only a request to change payment details.

The goal varies. Some campaigns aim to capture passwords on a fake sign-in page, sometimes relaying the login live so a one-time code is captured as well. Others deliver malware through an attachment or link. Others simply try to move money.

Defence combines technology and habits: email filtering and authentication, MFA that resists relay, and a culture where checking a request through a second channel is normal rather than awkward.

How it unfolds

1
Research
The attacker picks a theme, and for targeted attacks learns names, roles and suppliers.
2
Craft
A believable message, and often a copy of a real sign-in page, is created.
3
Send
The message is delivered by email, SMS, voice or chat.
4
Capture
Credentials are entered, a file is opened, or a payment is made.
5
Use
The attacker signs in, spreads further or moves the money.

Common techniques

Fake sign-in pages
Lookalike pages that collect passwords, sometimes relaying them to the real site in real time.
Urgent pretexts
Account problems, unpaid invoices or deadlines that push people to act quickly.
Lookalike domains
Addresses that differ from the real one by a character or an added word.
Malicious attachments and links
Files or links that install malware when opened.
Invoice and payment fraud
Requests to change bank details, sent as if from a supplier or executive.

Who is targeted

Finance and accounts teams
Executives and their assistants
Anyone with access to valuable systems or data
New starters who do not yet know normal processes

An example

A finance employee receives an email that looks like it comes from a supplier, saying their bank details have changed. It matches a real invoice and uses the supplier's usual wording. Without a separate check, the next payment goes to an account controlled by the attacker.

An illustrative scenario, not a report of a specific incident.

What to look for

Sender addresses that look almost, but not quite, right
Urgent language, threats or unusually generous offers
Links whose real destination differs from the text shown
Any request to change payment details or share a one-time code

How to defend

Verify payment changes and unusual requests through a second, trusted channel
Use phishing-resistant MFA such as passkeys or security keys where possible
Enable email authentication (SPF, DKIM, DMARC) and filtering
Make reporting easy, and thank people who report, even if it was harmless
Run short, regular awareness sessions using realistic examples

Key terms

Spear phishing: A phishing message tailored to a specific person or organisation.
BEC: Business email compromise: impersonation used to redirect payments or obtain data.
Smishing / vishing: Phishing by text message or by voice call.
AiTM: Adversary-in-the-middle: a fake page that relays a real login and captures the session.

This is a general profile of a type of threat. It does not attribute any specific incident to any named group.

Go deeper on phishing

Back to the Threat Atlas