CyberFurl can load analytics only after you opt in. Core product features work without analytics consent.
What is Phishing? Types, Examples, and 12 Controls to Stop It (2025)
Email Security
Phishing Explained: Every Attack Type and the 12 Technical & Human Controls That Stop Them
Phishing is the #1 ransomware entry point and BEC enabler — responsible for 36% of data breaches in 2024. Learn how spear phishing, whaling, smishing, vishing, and AiTM proxy attacks work, with real-world examples (MGM, Twitter) and the 12 technical plus human controls that stop them — including FIDO2 MFA, DMARC p=reject, and anti-phishing training.
Phishing is the #1 ransomware entry point and BEC enabler — responsible for 36% of data breaches in 2024.
What is phishing?
Phishing is the most common initial access technique in cyberattacks — responsible for 36% of all data breaches in the Verizon 2024 DBIR. It tricks people into revealing credentials, approving fraudulent payments, or executing malicious code by impersonating trusted entities through email, SMS, voice calls, or fake websites. Unlike exploit-based attacks, phishing targets human trust rather than technical vulnerabilities — making it effective even against well-patched systems.
Phishing is not one technique. It encompasses a family of attacks that share the same social engineering core: borrow legitimacy from a trusted brand, person, or process to lower the target's guard long enough to steal something valuable.
Phishing (mass): Untargeted, high-volume email campaigns with generic lures. "Your account will be suspended." Relies on volume — even a 0.1% click rate yields thousands of victims from a million-email campaign.
Spear phishing: Highly targeted email using research about the specific victim. References their role, coworkers, projects, or current events. Dramatically higher click rates than mass phishing. Often the precursor to BEC and ransomware.
Whaling: Spear phishing targeting senior executives (CEO, CFO, CISO, board). High-value targets with access to financial systems, sensitive data, and override authority. A single successful whaling attack can authorize multi-million dollar wire fraud.
Smishing: Phishing via SMS text message. Bypasses email security gateways. Common lures: fake bank alerts, package delivery notifications, government SMS programs. Growing rapidly as SMS lacks authentication infrastructure equivalent to email's DMARC.
Vishing: Phishing via voice call. No link required — the attacker uses voice social engineering to extract credentials or MFA tokens. MGM Resorts 2024 breach began with a vishing call to the IT helpdesk.
Clone phishing: Duplicating a legitimate email the victim previously received, replacing a link or attachment with a malicious version. Exploits existing trust in the communication chain.
AiTM (Adversary-in-the-Middle) phishing: The most sophisticated variant. The attacker proxies the real login portal in real-time — the victim sees and completes the genuine login including MFA, while the attacker captures the session cookie generated after successful authentication. Defeats all non-FIDO2 MFA. Tools like Evilginx2 make AiTM accessible to non-expert attackers.
How a phishing attack unfolds (the kill chain)
Most phishing campaigns follow a predictable operational sequence:
Reconnaissance (OSINT): Attacker scrapes LinkedIn, company website, SEC filings, data brokers to build target profiles — finding names, roles, email patterns, vendors, and current projects.
Infrastructure setup: Register lookalike domain → get TLS certificate (Let's Encrypt, free) → build credential-harvesting page (often pixel-perfect clone of Microsoft 365, Okta, or corporate VPN login).
Delivery: Send lure via email, SMS, or voice with urgency prompt ("Verify in 24 hours or your account is locked").
Credential capture / AiTM: Victim enters credentials. Classic sites write to a database. AiTM proxies relay credentials to the real login, get the session cookie, and relay the response — the victim sees a successful login while the attacker has an active authenticated session.
Post-compromise: Attacker uses stolen credentials to: access email inbox (for BEC reconnaissance), exfiltrate data (HIPAA, PCI, IP), pivot to connected systems (VPN, cloud, SSO), deploy ransomware.
The email click is the front door. The post-click activity is where the real damage happens — which is why fast incident reporting and phishing-resistant MFA are both critical.
Real phishing examples
MGM Resorts (2024): A vishing (voice phishing) call to the IT helpdesk from an attacker who found an employee's profile on LinkedIn. The attacker impersonated the employee convincingly enough that the helpdesk reset their MFA token. This single successful social engineering call led to ransomware deployment, paralyzed casino operations for days, and cost over $100 million.
Twitter (2020): Employees were targeted with phone-based social engineering convincing them to share internal admin credentials. The attacker accessed Twitter's admin tools and hijacked accounts of Barack Obama, Elon Musk, and other high-profile users for a Bitcoin scam — demonstrating that even technically sophisticated organizations are vulnerable to social engineering against their people.
Google and Facebook (2013-2015): A Lithuanian fraudster sent phishing emails posing as a legitimate Taiwanese hardware supplier to Google and Facebook's accounts payable departments. Over two years, he fraudulently invoiced over $100 million — both companies wired the money. The fraud exploited trust in the vendor relationship, not technical system vulnerabilities.
Red flags to identify phishing
Unexpected urgency: "Respond in 24 hours or your account will be permanently closed"
Sender domain mismatch: display name looks right, but the email domain is different from the real organization's
Credential or payment prompts from unsolicited contact
Links that do not match the displayed URL (hover before clicking)
Attachments from senders you were not expecting
Requests that bypass normal procedures ("keep this confidential from legal/compliance")
On mobile: the full sender address is hidden behind a display name — always expand it
12 anti-phishing controls: technical and human layers
Technical controls (7):
DMARC p=reject — eliminates exact-domain phishing of your brand
FIDO2/WebAuthn MFA — immune to AiTM proxy attacks that steal session cookies after MFA
Secure email gateway with click-time URL inspection and sandboxing
Brand monitoring for lookalike domain registration
Human controls (5):
8. Phishing simulations with realistic lures, quarterly cadence
9. Security awareness training focused on spear phishing, vishing, and AiTM patterns
10. Documented, psychologically safe reporting process for suspicious emails
11. Financial controls requiring multi-person authorization for wire transfers regardless of email request
12. Executive-specific briefings on whaling and BEC targeting (C-suite are highest-value, highest-risk targets)
What to do if you clicked a phishing link
step 1─────────>
step 2─────────>
step 3─────────>
step 4─────────>
step 5─────────>
step 6
1. Step 1:Publish and enforce DMARC at p=reject with valid SPF and DKIM alignment. This eliminates exact-domain phishing attacks against your domain — the highest-impact single control. Check current DMARC posture with a DMARC checker and begin the rollout process if not yet at enforcement. This directly neutralizes the email-based delivery vector for phishing targeting your employees and customers.
2. Step 2:Require FIDO2 hardware keys (YubiKey, etc.) or platform authenticators (Windows Hello, Touch ID) for all users — especially those with access to email, finance systems, and executive accounts. FIDO2 MFA is cryptographically bound to the legitimate domain and is completely immune to AiTM (adversary-in-the-middle) proxy attacks that steal session cookies after MFA completion. OTP and push-based MFA are defeatable by AiTM; FIDO2 is not. This is the single most impactful credential-protection control against sophisticated phishing.
3. Step 3:After DMARC enforcement, attackers pivot to lookalike domains. Implement continuous monitoring for newly registered domains that are typographic variants of your brand (typosquatting, homograph attacks, hyphenation variants). Alert on certificate transparency log entries for suspicious domains. When phishing infrastructure targeting your brand is detected, initiate takedown workflows through registrars and hosting providers. Speed matters — domains are often active for only hours before generating significant victim traffic.
4. Step 4:Route all inbound email through a Secure Email Gateway (SEG) that inspects URLs at click-time (not just at delivery), sandboxes attachments, detects impersonation via display-name and header analysis, and blocks known phishing domains and malicious senders. URL rewriting that re-evaluates links at click-time is important because attackers frequently use 'sleeping' domains that become malicious after passing initial delivery scanning.
Phishing and DMARC: complementary controls
DMARC at p=reject stops phishing attacks that use your exact domain in the From address — the highest-credibility form of phishing against your employees and customers. Without DMARC enforcement, attackers can perfectly impersonate your domain without any technical barrier.
But phishing is not exclusively email-based, and even email-based phishing uses vectors DMARC cannot reach: lookalike domains, compromised legitimate accounts, and display-name attacks. Complete phishing defense requires DMARC as a foundational layer plus brand monitoring for post-DMARC attack pivots and phishing-resistant MFA to protect credentials even when users click.
Technical Architecture
Phishing exploits the human authentication stack, not just technical protocols:
OSINT reconnaissance — LinkedIn, data brokers, public filings, conference talks
Credential capture — static form POST or real-time AiTM proxy with session cookie theft
Lateral movement — stolen SSO credentials → email inbox → connected apps → financial systems → data exfiltration or ransomware deployment
Common Defense Failures
Relying on training alone: Modern spear phishing uses perfect grammar, real context, and real email chains — training focused on typos and generic greetings misses it
Push MFA or SMS OTP: AiTM proxies defeat these in real time — only FIDO2 is phishing-resistant
Ignoring DMARC: Without enforcement, attackers never need lookalike domains — they use your exact domain, maximizing click rates
No post-click playbook: Security teams alerted 72 hours after a click cannot contain the post-compromise activity
Security Risks
Phishing is the primary entry point for:
Ransomware: 80%+ of ransomware deployments start with phished credentials or a phished endpoint
Data breaches: Exfiltration of customer PII, employee data, and intellectual property through compromised email or SSO access
Wire fraud: BEC via compromised or spoofed executive email to authorize fraudulent payments
Supply chain attacks: Phishing one vendor's employee to access systems shared with target organizations
Compliance Impact
HIPAA: A phished healthcare employee whose inbox contains ePHI triggers mandatory breach notification and OCR investigation
SEC Cybersecurity Disclosures (2023 rule): Material cybersecurity incidents must be disclosed within 4 business days — ransomware from a phishing attack typically qualifies
PCI-DSS 4.0: Requires robust anti-phishing controls, MFA, and security awareness training for all cardholder data environment access
Best Practices for Phishing Defense in 2025/2026
FIDO2 MFA is the top priority — no other MFA type is immune to AiTM phishing
DMARC p=reject closes the exact-domain attack surface — treat it as non-negotiable baseline
Brand monitoring is the DMARC complement — what happens after p=reject when attackers pivot
Make reporting safe and fast — delayed reports increase attacker dwell time exponentially
Assume some phishes will land — defense depth means the click is not game over: FIDO2 MFA, conditional access, and endpoint detection contain the blast radius
Tools to check your phishing exposure
Use CyberFurl brand protection monitoring to get a live view of your phishing attack surface: active spoofing of your domain in the wild, newly registered lookalike domains, and phishing campaigns targeting your customers. Run a simulated phishing test to benchmark employee resilience and identify training gaps. For DMARC enforcement status — the first technical layer against email-based phishing — check your domain's email authentication posture with the security report.
CF
How CyberFurl Helps
Automated monitoring. Zero manual work.
CyberFurl brand protection monitoring continuously scans for newly registered lookalike domains targeting your brand, monitors certificate transparency logs for phishing infrastructure, and parses DMARC aggregate reports to detect exact-domain phishing campaigns in real time. When phishing infrastructure is detected, CyberFurl provides domain and hosting evidence for takedown workflows.
What's the difference between phishing and spear phishing?
Phishing is broad and untargeted — mass emails sent to thousands of recipients hoping some will click. The lure is generic: 'Your account is expiring,' 'Urgent invoice attached.' Spear phishing is highly targeted — the attacker researches a specific individual (using LinkedIn, public filings, social media) and crafts a personalized lure that references their role, current projects, or known relationships. A spear phish from 'your law firm attorney' referencing a real deal closing is vastly more credible than a generic phish. Spear phishing has dramatically higher click rates. Whaling is the executive variant of spear phishing, targeting CEOs, CFOs, and board members specifically.
What is smishing?
Smishing is phishing conducted via SMS text message rather than email. 'Sms-phishing' attackers send fake bank alerts, package delivery notifications, or government benefit messages with links to credential-harvesting sites. Smishing is growing rapidly because SMS bypasses email security filters entirely and many users are less suspicious of text messages. Indicators of smishing: unexpected text from unknown or spoofed number, link that does not match the claimed sender's legitimate domain, urgency prompts ('Verify now or your account will be locked'). Vishing is the voice call variant — attackers call targets directly and use social engineering without any link required.
Can DMARC stop all phishing?
DMARC at p=reject stops exact-domain phishing attacks — where the From address shows your precise corporate domain. This eliminates a major category of phishing that targets your employees and customers. However, DMARC does not stop: phishing that uses lookalike domains (yourcompany-secure.com), phishing from legitimate but compromised accounts, smishing and vishing (no email authentication involved), or AiTM proxy attacks where the phishing page is invisible to email filters. DMARC is an essential layer in an anti-phishing stack — not the complete stack. It must be combined with phishing-resistant MFA, security awareness training, brand monitoring, and endpoint detection.
What should I do if I clicked a phishing link?
Treat the click as the start of an incident, not the whole incident. Immediately: (1) Do not enter any credentials on the page if you caught it in time. (2) Disconnect from the corporate network if you are on a work device. (3) Report the click to your security team — immediately, not days later. (4) Change your password for the service the phish impersonated, using a different device if possible. (5) If you entered credentials: reset all related accounts, check for active sessions in the account's security settings, and notify your security team to look for any subsequent account activity. (6) If you downloaded a file: assume the device is compromised — escalate to IR team for endpoint investigation. Security teams need the report quickly to contain any post-click activity.
What is phishing?
Phishing is a social engineering attack that tricks people into revealing credentials, approving fraudulent transactions, or executing malware by impersonating trusted entities via email, SMS, voice calls, or fake websites. Phishing is the most common initial access vector for ransomware and data breaches — the Verizon DBIR 2024 found that phishing was involved in 36% of data breaches globally. Unlike malware that exploits technical vulnerabilities, phishing exploits human trust, urgency, authority, and familiarity. Technical controls like DMARC, email gateways, and URL scanning reduce the attack surface, but human judgment remains part of the defense stack — which is why security awareness training and phishing-resistant MFA are critical complements to technical controls.
What is an AiTM phishing attack and how is it different from regular phishing?
AiTM (Adversary-in-the-Middle) phishing uses a reverse proxy server positioned between the victim and the real login portal. Instead of a static credential-harvesting page, the AiTM proxy fetches and relays the genuine Microsoft 365, Okta, or Google login page in real time — including the MFA challenge. The victim completes the real login including MFA, while the proxy captures the session cookie generated after successful authentication. The attacker uses this cookie to access the session without ever needing the password or MFA code. This attack defeats SMS OTP, email OTP, TOTP apps, and push-based MFA — only FIDO2/WebAuthn keys are immune because the cryptographic challenge is cryptographically bound to the legitimate domain and cannot be proxied. Tools like Evilginx2 make AiTM accessible to low-skill attackers.
How do I run an effective phishing simulation?
Effective phishing simulations require three elements: realistic lures, structured learning, and psychological safety. On lure design: use industry-specific scenarios relevant to employee roles — invoice approval for finance, IT password reset for all staff, DocuSign document for legal. Avoid obvious tells like poor grammar; test with realistic copy and accurate-looking sender addresses. On frequency: run simulations quarterly, not annually, and vary the attack type — include spear phishing using research about specific team members alongside mass phishing tests. On response: when an employee clicks, provide immediate interactive training (not just a failure page) explaining what signals they missed. Track click rates by department over time to measure improvement. Critical: make reporting psychologically safe — punitive cultures suppress reporting, which increases attacker dwell time dramatically after real phishing lands.
5. Step 5:Conduct quarterly phishing simulations targeting realistic attack patterns — not just generic 'click the link' tests. Include spear phishing templates using realistic contextual details (project names, vendor names, executive names). Track click rates by team and role. Provide immediate, non-punitive education to clickers. Focus training on: visual verification of sender address (especially on mobile), recognizing urgency and authority as manipulation signals, and the specific reporting procedure for suspicious messages.
6. Step 6:Establish a documented, accessible procedure for phishing click incidents: how to report, who to contact, what to do immediately, what the security team investigates, and how long investigation takes. Fast reporting enables security teams to contain post-click activity (revoke sessions, isolate endpoint, block malicious IPs) before attackers escalate access. Make reporting psychologically safe — employees who fear punishment for clicking phish are less likely to report, which increases attacker dwell time dramatically.
