What is Phishing?
Phishing is a cyberattack where attackers trick victims into providing sensitive information, like usernames, passwords or credit card numbers. Attackers do this by masquerading as trusted entities in electronic communications, such as email, text messages, phone calls, or websites. Attackers then use this information to steal credentials and access the victim’s organization’s network.
Attackers create phishing emails that appear to come from popular brands, such as banks or retailers. They also impersonate executives from organizations. When employees receive an email that appears to come from a trusted brand, they are more likely to click links or download attachments. These files contain malicious code that phishers can use to steal login credentials, hijack real accounts, and even take over the computer system. Attackers then sell stolen data or account information on the black market.
Scammers will often create a sense of urgency to get their victims to act quickly. This can be done by claiming there is an emergency, such as a security breach or that the victim will be fined. Attackers will also try to frighten victims by saying they have been watching inappropriate videos or that their children are stealing money.
A more targeted type of phishing is known as whaling, which targets employees at the highest levels of an organization. This includes CEOs, CFOs and executives in key strategic roles. It can be accomplished through email, voice phishing (vishing) and SMS text message phishing (SMiShing). This is the most costly of all phishing attacks, due to the ability to drain bank accounts.