Phishing

1. Introduction to Phishing

Phishing is a form of social engineering in which an attacker
uses deceptive communication to persuade a person to reveal information,
perform an action, visit a malicious destination or provide access to a system.

Phishing commonly uses email, websites, text messages, social media,
messaging applications and other communication channels.

The attacker may pretend to be a trusted person, company, service,
administrator, colleague or institution.

2. Why Phishing Matters

Phishing remains important because a successful message can become the first
stage of a much larger attack.

A phishing campaign may attempt to obtain:

• Usernames and passwords
• Authentication codes
• Financial information
• Personal information
• Business documents
• Cloud-service access
• Remote-access credentials

A successful phishing attempt may also persuade a user to install malware,
approve an unexpected authentication request or transfer money.

3. Phishing and Social Engineering

Phishing is closely related to social engineering.
Social engineering involves manipulating people into taking actions that
benefit an attacker.

Common psychological techniques include:

• Urgency
• Fear
• Authority
• Curiosity
• Trust
• Scarcity
• Reward
• Impersonation

For example, an attacker may claim that an account will be suspended unless
the victim immediately signs in.

4. Phishing Email

Email is one of the most common phishing delivery channels.

A suspicious message may contain a malicious link, attachment or request for
sensitive information.

However, poor grammar alone should not be treated as proof of phishing.
Modern phishing messages can be professionally written and may closely imitate
legitimate organizations.

5. Spear Phishing

Spear phishing is a targeted phishing attempt directed at a
specific individual, department or organization.

Attackers may research their target before sending the message in order to
make the communication appear more credible.

For example, a message may reference the recipient’s job role, organization,
current project or known business relationship.

6. Whaling

Whaling is a form of targeted phishing aimed at high-value
individuals, such as executives or senior decision-makers.

The attacker may attempt to exploit the authority or responsibilities
associated with the target’s position.

7. Smishing

Smishing is phishing delivered through SMS or text messaging.

A fraudulent message may claim to come from a bank, delivery company,
government service, telecommunications provider or another organization.

The message may contain a link leading to a fraudulent website.

8. Vishing

Vishing means voice phishing.

The attacker uses a telephone call or voice communication to deceive a target
into revealing information or performing an action.

Attackers may impersonate technical support staff, financial institutions,
government agencies or company employees.

9. Business Email Compromise

Business Email Compromise (BEC) involves deceptive use of
email or related accounts to influence business transactions or access
information.

A fraudulent request may appear to come from an executive, supplier,
customer or colleague.

Common targets can include payment processes, invoices, payroll information
and sensitive business communications.

10. Phishing Websites

A phishing website is designed to imitate a legitimate website or service in
order to deceive visitors.

For example, a fraudulent login page may visually resemble a legitimate
cloud-service login page.

The attacker may attempt to collect credentials entered by the victim.

11. Look at the Domain Carefully

One useful phishing-detection technique is examining the actual domain name.

An attacker may use a domain that looks similar to a legitimate organization
while actually belonging to another party.

Security learners should examine the complete domain rather than relying only
on the visible branding or page design.

12. URL Deception

Attackers may attempt to make URLs appear trustworthy by using misleading
subdomains, unusual paths, URL shorteners or visually confusing domain names.

Users should avoid opening suspicious links and instead navigate to important
services through a trusted bookmark or by manually entering a known address.

13. Malicious Attachments

Phishing messages may contain attachments designed to persuade users to open
or execute content.

Examples can include:

• Documents
• Compressed archives
• Scripts
• Executable files
• Disk-image files

Unexpected attachments should be treated cautiously, especially when they
request that the user enable macros, run software or bypass security warnings.

14. Credential Harvesting

A common phishing objective is credential harvesting.

The victim may be directed to a fraudulent login page where the entered
username and password are collected by the attacker.

Multi-factor authentication can reduce the impact of password theft, although
some phishing campaigns are designed to target additional authentication
steps as well.

15. Authentication Fatigue

Attackers may attempt to overwhelm a victim with repeated authentication
requests in the hope that the person eventually approves one.

Users should never approve authentication requests they did not initiate.
Unexpected authentication prompts should be reported to the appropriate
security or IT team.

16. Common Phishing Warning Signs

Potential indicators include:

• Unexpected requests for passwords
• Unexpected authentication requests
• Urgent payment requests
• Unexpected account warnings
• Unusual sender addresses
• Suspicious domains
• Unexpected attachments
• Links that do not match the claimed destination
• Requests to bypass normal procedures
• Unusual requests for confidential information

No single indicator proves that a message is malicious. The context and
available evidence should be considered together.

17. Sender Address Analysis

The sender’s display name can be misleading.

A message that displays a familiar name may originate from a different email
address.

Security awareness training should therefore teach users to examine the
actual sender address rather than relying only on the displayed name.

18. Reply-To Manipulation

Some email systems allow a message to specify a different reply-to address.

An attacker may use this technique to make a message appear legitimate while
directing replies to another account.

When a message requests sensitive information, verify the request through an
independent trusted communication channel.

19. Urgency and Fear

Attackers frequently use urgency to discourage careful verification.

Examples include messages claiming:

• Your account will be closed today.
• Your payment has failed.
• Your package cannot be delivered.
• Your password will expire immediately.
• Your organization has detected suspicious activity.

The safest response is to slow down and verify the request independently.

20. Authority and Impersonation

Attackers may impersonate people with authority.

A fraudulent request may appear to come from a manager, executive, bank,
administrator or government organization.

Organizations should establish procedures that require verification for
sensitive requests regardless of who appears to have made them.

21. Phishing and Financial Fraud

Some phishing campaigns attempt to redirect payments or obtain financial
information.

Organizations can reduce risk through:

• Payment verification procedures
• Separation of duties
• Approval workflows
• Independent confirmation of unusual requests
• Monitoring of financial transactions

22. Phishing and Malware

Phishing and malware can be connected.

A phishing message may attempt to persuade a user to download or execute
malware.

This is why users should not treat links and attachments as harmless simply
because they arrive through email.

23. Phishing and Account Takeover

Stolen credentials may allow attackers to attempt unauthorized access to
online accounts.

The consequences can include:

• Email compromise
• Cloud-service compromise
• Unauthorized access to business information
• Impersonation of the victim
• Further phishing from the compromised account

24. Multi-Factor Authentication

Multi-factor authentication (MFA) requires more than one
authentication factor.

MFA can provide additional protection when a password is stolen.

Organizations should also educate users about unexpected authentication
requests and use stronger phishing-resistant authentication methods where
appropriate.

25. Email Security Controls

Organizations can deploy technical controls to reduce phishing exposure.

• Spam filtering
• Malware scanning
• Attachment inspection
• URL reputation checking
• Sender authentication
• Domain protection
• Email quarantine
• User reporting mechanisms

26. SPF, DKIM and DMARC

Email security can use standards such as SPF,
DKIM and DMARC.

• SPF helps a domain specify which mail servers are authorized
  to send email for that domain.
• DKIM uses cryptographic signatures to help verify that an
  email was authorized by the sending domain and was not altered in transit.
• DMARC allows domain owners to publish policies for handling
  messages that fail relevant authentication checks and provides reporting
  capabilities.

These technologies improve email authentication but do not eliminate every
form of phishing.

27. Safe Response to a Suspicious Message

When a suspicious message is received:

1. Do not click unexpected links.
2. Do not open suspicious attachments.
3. Do not provide passwords or authentication codes.
4. Verify important requests independently.
5. Report the message through the organization’s approved process.
6. Delete or quarantine it according to organizational procedures.

28. What If You Already Clicked?

If a user accidentally clicks a suspicious link, the correct response is to
report it quickly rather than hiding the incident.

Depending on the situation, security personnel may need to:

• Determine what page was accessed.
• Check whether credentials were entered.
• Reset affected credentials.
• Review authentication logs.
• Inspect the endpoint.
• Block malicious indicators where appropriate.
• Monitor for further suspicious activity.

29. Independent Verification

One of the most useful defenses against phishing is independent verification.

If an email requests a sensitive action, contact the supposed sender using a
known telephone number, trusted internal directory or established
communication channel.

Do not use contact information supplied only by the suspicious message.

30. Phishing Investigation Scenario

Suppose an employee receives an email apparently from a company executive.
The message asks the employee to urgently change a supplier’s bank account
details.

The employee should not immediately process the request.

A safer procedure is:

1. Recognize that the request involves financial risk.
2. Check the actual sender address.
3. Inspect the message context.
4. Verify the request through an independent channel.
5. Follow the organization’s payment-approval process.
6. Report suspicious activity to the security team.

31. Authorized Phishing Awareness Exercise

For classroom training, instructors can create clearly labeled simulated
phishing examples that do not collect real passwords or personal information.

Students can examine:

• Sender information
• Subject line
• Urgency language
• Links
• Attachment names
• Domain names
• Requested action

32. Safe PHP Example — Phishing Indicator Check

The following example demonstrates simple defensive analysis of a URL. It
does not visit the website or attempt to collect credentials.

<?php

$url = 'https://example.com/login';

$parts = wp_parse_url( $url );

if ( ! empty( $parts['scheme'] ) &&
	'https' === strtolower( $parts['scheme'] ) &&
	! empty( $parts['host'] ) ) {

	echo 'HTTPS URL detected.<br>';
	echo 'Host: ' .
		htmlspecialchars(
			$parts['host'],
			ENT_QUOTES,
			'UTF-8'
		);

} else {

	echo 'Review the URL carefully before visiting.';
}

This example demonstrates URL inspection only. HTTPS alone does not establish
that a website is trustworthy.

33. Phishing Detection Checklist

34. Phishing and Cybersecurity Teams

Security teams should provide a simple mechanism for users to report
suspicious messages.

Reported messages can help security teams identify campaigns, block malicious
indicators and determine whether other users were targeted.

Rapid reporting can be especially valuable when phishing is part of a wider
attack.

35. Practical Exercise

Create three clearly labeled fictional phishing messages for classroom
analysis. Do not send them to real users.

For each message, identify:

1. The claimed sender
2. The actual sender address
3. The requested action
4. The urgency technique
5. The suspicious link or domain
6. Potential consequences
7. The correct defensive response

36. Review Questions

1. What is phishing?
2. Why is phishing considered a form of social engineering?
3. What is spear phishing?
4. What is whaling?
5. What is smishing?
6. What is vishing?
7. What is business email compromise?
8. Why should users inspect the actual sender address?
9. Why is HTTPS alone not proof that a website is legitimate?
10. How can phishing lead to malware infection?
11. How can phishing lead to account compromise?
12. What is credential harvesting?
13. How does multi-factor authentication reduce risk?
14. What are SPF, DKIM and DMARC?
15. Why is independent verification important?
16. What should a user do after accidentally clicking a suspicious link?
17. Why should suspicious messages be reported?
18. Why should phishing simulations be authorized?

37. Key Takeaways

• Phishing uses deception to influence users into taking an unsafe action.
• Phishing can target credentials, financial information, accounts and systems.
• Spear phishing targets specific individuals or organizations.
• Whaling targets high-value individuals.
• Smishing uses text messages.
• Vishing uses voice communication.
• Business email compromise can involve fraudulent business requests.
• Urgency and authority are common social-engineering techniques.
• Users should inspect sender addresses and domains carefully.
• HTTPS does not prove that a website is legitimate.
• MFA provides additional protection when passwords are compromised.
• SPF, DKIM and DMARC can strengthen email authentication.
• Important requests should be independently verified.
• Suspicious messages should be reported through approved channels.
• Phishing exercises must be conducted only with proper authorization.

38. Conclusion

Phishing is one of the most important cybersecurity threats because it combines
technology with human deception. Attackers may use carefully crafted messages,
fraudulent websites, impersonation and psychological pressure to persuade
users to take actions that create security risks.

Effective defense requires a combination of user awareness, technical
controls, strong authentication, email security, verification procedures and
rapid reporting.

In the next lesson, we will examine the broader techniques attackers use to
manipulate people:
Social Engineering.