phishing
termsecurityhacking
Tricking someone into revealing credentials or running malware, usually by email.
Phishing weaponizes trust rather than code: a message that looks legitimate lures the target into clicking, logging in, or paying. "Spear phishing" is tailored to one person; "whaling" targets executives. It remains one of the most reliable ways in, because it attacks the human, not the firewall.
Phishing persists because it attacks the person rather than the system, and no patch closes that. The message asks for something plausible in a context that feels normal, and the defence has to work on a tired human at the end of a long day rather than on a well-rested one reading a security bulletin.
The sophistication has moved well past bad grammar. Targeted attacks reference real projects and real colleagues, arrive at plausible moments, and increasingly clone the sender's writing style from material that is publicly available. Business email compromise skips malware entirely and simply asks for a payment to be redirected, which no attachment scanner will ever catch because there is nothing malicious in the message except its intent.
The defences that actually work reduce what a successful attempt achieves rather than trying to make people infallible. Phishing-resistant authentication is the big one, because a hardware key verifies the site's origin and will not authenticate to a lookalike domain regardless of how convinced the user is. Beyond that: mail authentication so impersonating your own domain is hard, and a reporting culture where people are thanked for flagging rather than blamed for clicking, since punishment produces silence rather than safety.
Also known as: spear phishing, spear-phishing, whaling