Phishing is a form of social engineering in which an attacker tries to trick someone into revealing sensitive information, granting access, or installing malware. This lesson introduces the goals of phishing and the most common ways it reaches people.
Phishing is a scam that uses deception to persuade a person to disclose information or take an unsafe action. A message may appear to come from a bank, government agency, employer, or familiar service. It may send the recipient to a counterfeit login page, ask for a password, or encourage them to open a harmful attachment.
All flashcards
What is phishing?
A form of social engineering in which an attacker deceives someone into revealing sensitive information, granting access, or installing or running something harmful.
How do general phishing and spear phishing differ?
General phishing is broadly distributed. Spear phishing is tailored to a specific person or group, often using information that makes the lure seem relevant.
What is whaling?
A form of spear phishing aimed at senior leaders or other high-value individuals to obtain valuable information or access.
What are vishing and smishing?
Vishing delivers a phishing lure through a voice call. Smishing delivers it through SMS or MMS text messages.
What makes an AiTM phishing attack dangerous?
The impostor site can relay a victim's sign-in to the real service, capture a one-time code, and potentially obtain an authenticated session cookie.
Quiz questions
In the URL `example.com.scam.com`, which domain controls the hostname?Answer: scam.com
What does a DMARC pass establish about an email?Answer: An SPF or DKIM identifier passed and aligned with the author domain.
How does WebAuthn help resist phishing when correctly implemented?Answer: It binds a cryptographic response to the authenticated relying-party domain.
What is a watering-hole attack?Answer: An operation that targets a website frequented by a particular community or organization.
If a work account's credentials or session may be compromised, what is an appropriate response?Answer: Use a trusted route to secure the account and promptly notify the organization's security team.
Based on the Wikipedia article Phishing, licensed CC BY-SA 4.0. Adapted into a summary, flashcards and quizzes.