Phishing

Phishing is an attack in which a criminal impersonates a trusted party, a bank, a colleague or a supplier, in order to obtain credentials, a payment or access to a network. The target is the person rather than a technical flaw in the software.

What it means

The variants differ mainly in how narrowly they are aimed. Mass phishing goes out as a generic email to thousands of recipients at once. Spear phishing is tailored to one person or one team and draws on details from social media, a data breach or a mailbox the attacker already controls. Whaling targets executives and others who can authorise payments. The attack has also left the inbox: smishing (SMS phishing) arrives by text or chat, vishing (voice phishing) by telephone, these days sometimes with a cloned voice.

Why it matters

Phishing has been one of the most common routes to initial access for years, and initial access is what ransomware and invoice fraud are built on. What has changed is that multi-factor authentication (MFA) on its own no longer settles the question. A modern phishing kit no longer serves a copied login page. It runs as a reverse proxy and relays the victim’s input to the provider’s real site in real time. The victim sees the genuine login screen, approves the genuine MFA prompt and really does sign in. The kit reads the one-time code in passing and, more valuable still, the session cookie issued afterwards. With that cookie the attacker is inside, having never needed the code.

The distinction that matters is therefore not whether MFA is switched on, but whether the factors in use are phishing-resistant. Codes from an authenticator app, SMS messages and push approvals can all be relayed by a party in the middle. Passkeys and hardware keys based on FIDO2/WebAuthn cannot: the key is bound to the domain it was registered for and simply refuses to sign for the attacker’s domain. Awareness training and a report button remain useful, but the structural fix sits in the login mechanism itself.

Example

An employee is told that a shared document is waiting and signs in through the link, on what looks like the company portal. Password, MFA, everything works, and the document even opens. Behind the scenes a reverse proxy has copied the session cookie. An hour later, monitoring flags a sign-in from an unfamiliar network. No password was cracked and no vulnerability was exploited.