If you’ve worked in security for any length of time, you already know phishing isn’t going away. It’s the oldest trick in the social engineering playbook, and it still works because it doesn’t target your firewall — it targets you. I’ve spent years reading incident reports where the root cause line reads the same way: “user clicked a link in an email.” Simple sentence, expensive consequences.
In this article I want to walk through every major category of phishing I’ve encountered or researched, from the classic mass-email spray to the highly targeted attacks that fool even experienced professionals. I’ll also cover the mechanics behind each one, real incidents tied to them, and what actually works to stop them.
What Phishing Actually Is
Phishing is a form of social engineering where an attacker impersonates a trusted entity to trick a victim into handing over credentials, money, or access. The name is a play on “fishing” — bait, hook, and a victim who bites. The first documented use of the term dates back to the mid-1990s, when attackers on AOL impersonated staff to steal account credentials. Thirty years later, the bait has gotten far more convincing, but the psychology hasn’t changed much: urgency, authority, fear, and curiosity are still the four levers attackers pull.
The Main Types of Phishing Attacks
1. Email Phishing (Mass/Spray Phishing)
This is the classic. An attacker sends the same generic email — “Your account has been suspended,” “Invoice attached,” “Verify your password” — to thousands or millions of addresses, hoping a small percentage bite. Volume compensates for low conversion rates.
2. Spear Phishing
Spear phishing is targeted. The attacker researches a specific person or organization — job title, colleagues, recent projects, even writing style — and crafts a message that feels personal. This is where reconnaissance techniques like OSINT and LinkedIn scraping come into play. Spear phishing has a dramatically higher success rate than mass phishing because the message feels legitimate.
3. Whaling
Whaling is spear phishing aimed at senior executives — CEOs, CFOs, board members. The payoff is bigger, so attackers invest more effort. A famous example is the 2016 attack on Austrian aerospace firm FACC, where attackers impersonating the CEO tricked an employee into wiring roughly €50 million to a fraudulent account.
4. Business Email Compromise (BEC)
BEC is a step beyond whaling. Instead of just impersonating an executive, attackers often compromise a real executive or vendor email account (or spoof it convincingly) and use it to redirect invoice payments or request wire transfers. The FBI’s IC3 has consistently ranked BEC among the costliest cybercrime categories, with losses in the billions of dollars annually.
5. Smishing (SMS Phishing)
Smishing delivers the phishing lure through text messages — fake delivery notifications, bank alerts, or “your account has been locked” texts with a malicious link. It exploits the fact that people trust SMS more than email and often read texts on the move, without scrutinizing links carefully.
6. Vishing (Voice Phishing)
Vishing happens over phone calls, often combined with caller ID spoofing. Attackers impersonate banks, tech support, or government agencies. The rise of AI voice cloning has made vishing more dangerous — there are now documented cases of attackers cloning a family member’s or executive’s voice to request urgent money transfers.
7. Clone Phishing
The attacker takes a legitimate email the victim has already received, duplicates it almost exactly, but swaps the link or attachment for a malicious one. Because the victim recognizes the format, trust is inherited from the original message.
8. Angler Phishing
This one targets social media. Attackers monitor public complaints directed at brands (airlines, banks, retailers) and respond posing as customer support, directing the frustrated user to a fake “support” link to “resolve” their issue.
9. Pharming
Pharming doesn’t rely on a lure at all — it redirects victims to a fake website even when they type the correct URL, usually by poisoning DNS records or a local hosts file. It’s technically closer to a network attack than social engineering, but the end goal — stealing credentials via a fake login page — is identical to phishing.
10. Pop-up Phishing
Fake pop-up windows mimic legitimate system or browser alerts (“Your computer is infected, call this number now”) to scare users into calling a fraudulent support line or downloading malware disguised as a “fix.”
11. Evil Twin / Wi-Fi Phishing
Attackers set up a rogue wireless access point with a name resembling a legitimate network (like “Airport_Free_WiFi”) to intercept traffic or present a fake captive portal that harvests login credentials.
12. Search Engine Phishing
Attackers create fake websites and use SEO manipulation or paid ads to rank them highly for search terms related to banking, software downloads, or customer support, catching users who trust top search results.
13. HTTPS Phishing
A reminder that the padlock icon in a browser only confirms encryption, not legitimacy. Attackers now routinely use free TLS certificates (via services like Let’s Encrypt) on phishing domains, so “the site has HTTPS” is no longer a meaningful trust signal.
Comparison Table
| Type | Delivery Channel | Target Scope | Sophistication |
|---|---|---|---|
| Email phishing | Mass | Low | |
| Spear phishing | Individual/small group | High | |
| Whaling | Executives | High | |
| BEC | Email/compromised accounts | Organizations | Very high |
| Smishing | SMS | Mass/individual | Low-Medium |
| Vishing | Phone/voice | Individual | Medium-High |
| Clone phishing | Individual/mass | Medium | |
| Angler phishing | Social media | Individual | Medium |
| Pharming | DNS/network | Mass | High |
| Evil twin | Wi-Fi | Individual/local group | Medium |
How a Phishing Attack Chain Typically Works
flowchart TD
A[Reconnaissance: gather targets and context] --> B[Craft lure: email, SMS, call script]
B --> C[Delivery: send message or set up fake infrastructure]
C --> D{Victim interacts?}
D -- No --> E[Attack fails / logged by filters]
D -- Yes --> F[Credential harvest or malware execution]
F --> G[Initial access gained]
G --> H[Lateral movement / fraud / data exfiltration]
Real-World Case Studies
Google and Facebook (2013–2015): A Lithuanian man ran a BEC scheme against both companies by impersonating a hardware vendor, ultimately extracting over $100 million through fraudulent invoices before being caught.
Twitter’s 2020 Bitcoin Scam: Attackers used vishing to trick Twitter employees into giving up internal tool access, which was then used to hijack high-profile accounts and push a cryptocurrency scam. This showed that even employees at security-conscious companies are vulnerable to a well-executed phone pretext.
Target’s 2013 Breach: While not phishing directly, the initial foothold came from credentials stolen from a third-party HVAC vendor via a phishing email — a good reminder that phishing risk extends through your supply chain, not just your own inbox.
Defensive Strategies
- Email authentication: Implement SPF, DKIM, and DMARC to reduce domain spoofing.
- Security awareness training: Regular, realistic phishing simulations reduce click rates significantly over time.
- MFA everywhere: Even if credentials are stolen, multi-factor authentication blocks most automated account takeovers (though MFA fatigue attacks are a growing countermeasure attackers use).
- URL and attachment sandboxing: Inspect links and attachments before they reach the user’s inbox.
- Out-of-band verification: For wire transfers or sensitive requests, verify through a second channel (a phone call to a known number, not one in the email).
- Browser isolation and DNS filtering: Blocks access to known-bad domains even if a user clicks.
Common Mistakes Organizations Make
- Treating phishing training as a once-a-year checkbox instead of an ongoing program.
- Punishing employees who fall for simulated phishing tests, which discourages future reporting.
- Relying solely on spam filters without user education.
- Ignoring smishing and vishing because “our policy only covers email.”
- Not having a clear, fast reporting mechanism for suspicious messages.
Mapping to Industry Frameworks
- MITRE ATT&CK: Phishing is documented under Initial Access, Technique T1566, with sub-techniques for spearphishing attachment (T1566.001), spearphishing link (T1566.002), and spearphishing via service (T1566.003).
- NIST SP 800-61: Provides incident handling guidance relevant to phishing-triggered incidents.
- OWASP: While primarily focused on application security, OWASP’s guidance on authentication and session management complements anti-phishing controls.
FAQs
Is phishing illegal? Yes. Phishing typically violates computer fraud, wire fraud, and identity theft laws depending on jurisdiction.
Can antivirus software stop phishing? Partially. It can catch malicious attachments and known-bad URLs, but it can’t stop a user from voluntarily typing credentials into a convincing fake login page.
What’s the single most effective defense? A combination of MFA and user awareness training consistently produces the biggest measurable drop in successful attacks.
Are phishing attacks increasing? Yes — reporting from major security vendors and the FBI’s IC3 has shown phishing and BEC losses trending upward year over year, accelerated by AI tools that make lures more convincing.
Summary and Recommendations
Phishing isn’t one attack — it’s a family of techniques united by a single idea: exploit trust faster than technology can verify it. Understanding each variant, from mass email spam to AI-assisted vishing, is the first step toward building layered defenses that don’t rely on any single control.
For further reading:
- MITRE ATT&CK Phishing Technique: https://attack.mitre.org/techniques/T1566/
- FBI IC3 Annual Reports: https://www.ic3.gov/
- NIST SP 800-61 Computer Security Incident Handling Guide: https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final
- OWASP: https://owasp.org/
