Phishing

• 1. Introduction

  ›

  Phishing is a scam in which attackers deceive people into revealing sensitive information or installing malware, such as viruses, worms, adware or ransomware. In 2017-72 percent of businesses reported being hit by it. By 2020 that figure had climbed to 86 percent, and in 2023 it reached 94 percent. Phishing is now described as the most prevalent type of cybercrime in the world. Why does a trick this old keep working? Where did the strange name come from, and who first put it to use? How do attackers slip past passwords and even second login steps? And what have banks, browser makers, courts and lawmakers done to push back?

  7274467320

• 2. Hunting Ground at AOL

  ›

  In the 1990s, black hat hackers and the warez community turned America Online into a hunting ground for credit card information. They used the service to steal card details and commit other online crimes. A cracking toolkit called AOHell made the work easier. It let hackers pose as AOL staff and send instant messages that asked victims to reveal their passwords.

  The name for this trick is a pun. Phishing is a variation on fishing, and the idea is that attackers cast out lures to catch sensitive information. Khan C. Smith, a well-known spammer and hacker, is said to have coined the term. AOL responded with protective measures and eventually shut down the warez scene on its platform.

  The first recorded use of the word appears in AOHell, yet the hacker magazine 2600 may have printed it earlier. Nobody has settled exactly who said it first.

  3334353611

• 3. Casting the Lures

  ›

  Most phishing starts as bulk email, sent to a wide audience with no particular victim in mind. Common targets include financial institutions, email and cloud productivity providers, and streaming services. Stolen access can be used to steal money, install malware, or phish colleagues inside the same organization. Hijacked streaming accounts may even be sold on darknet markets.

  Spear phishing narrows the aim. Attackers tailor the message to a specific person, using personal or organizational details to look credible. Executives and finance staff are favorite targets, and accountancy and audit firms are especially exposed because of the information their employees can reach. Threat Group-4127, also known as Fancy Bear or GRU Unit 26165, used this approach against Hillary Clinton's 2016 presidential campaign. It went after more than 1,800 Google accounts.

  Susceptibility varies with age. In one study, simulated phishing links arrived in daily emails for 21 days. Some 43 percent of people aged 18 to 25 clicked, against 58 percent of older users. Older women were the most susceptible, and their rate stayed stable while younger users improved.

  Voice phishing, or vishing, relies on internet telephony. Attackers place automated calls to large numbers of people, often with text-to-speech software, and claim there is fraud on the account. They spoof the caller number so it looks like a bank, then ask for sensitive details or hand the victim to a live person. Vishing exploits the fact that people trust the telephone more than email.

  Smishing delivers the bait by text message. Senders pretend to be government officers, customer support, shippers, a boss, or even a wrong number. Mobile browsers show only a small part of a web address, which makes a bad link harder to spot.

  Page hijacking works from the other direction. Attackers compromise a legitimate website, often through cross-site scripting, and plant malicious inline frames or exploit kits such as MPack. Visitors who trusted the site get infected. The tactic is often paired with watering hole attacks on corporate targets.

  Then there is quishing, which hides a malicious link inside a QR code. Scammers sometimes stick fake codes over real ones on advertisements or car park notices. Because the link is an image, it can slip past email filters. Criminals can even combine a bogus code with a Browser-in-the-Browser trick to win approval for the attacker's two-factor access.

  4316389

• 4. The Art of Disguise

  ›

  A single Cyrillic letter that looks identical to the Latin letter a can be enough to fool a careful reader. Internationalized domain names allow this kind of homograph attack. Phishers register addresses that look the same as a trusted one, then send victims to the malicious site. Some of them also abuse open redirectors on trusted websites to hide the real destination.

  Ordinary link tricks are just as effective. Attackers use misspelled web addresses, or place a trusted brand name in a subdomain so that the fraudster's own domain sits further along the address. Another trick is displaying trustworthy text while the link underneath points to the phisher. Hovering over a link usually shows the true address in the status bar, although some phishers can defeat that check.

  Pressure does much of the remaining work. Messages impersonate a trusted organization and warn that a bank or insurance account is about to be closed or seized. Some attackers skip impersonation and use fake news articles instead. The links lead to sites that try to install malware or flash invented virus warnings.

  Generative AI is now a major concern. It makes text and images more realistic, helps attackers choose their victims, and automates the attacks. Phishing messages that once gave themselves away with clumsy wording are becoming harder to tell apart from the real thing.

  2425223223

• 5. The Man in the Middle

  ›

  Evilginx began as an open-source tool for penetration testing and ethical hacking. Criminals repurposed it for a kind of attack that defeats two-factor authentication. Traditional phishing could only capture credentials typed into a fake page. Man-in-the-middle phishing places a tool between the victim and the genuine service, so the real site answers every request.

  Evilginx passes information back and forth without saving passwords or login codes. That makes it harder for security systems to catch, since they usually hunt for phishing sites that store stolen data. Instead, the tool grabs login tokens and session cookies the moment they appear. The attacker can then enter the account as the real user for as long as the session stays active.

  Victims are lured in through phishing emails, social engineering, or malicious links shared on social media. Once they interact with the counterfeit site, the tool intercepts the authentication step and the second factor offers no protection.

  Some multi-factor schemes were built to close this gap. WebAuthn is one of them, designed so that this kind of relay fails by design.

  1881821920

• 6. Money, Breaches and Headlines

  ›

  Between May 2004 and May 2005, about 1.2 million computer users in the United States lost roughly US$929 million to phishing. By then the crime had grown into an organized part of the black market. Specialists sold phishing software for payment, and gangs assembled it into campaigns. The first known direct attempt against a payment system, E-gold, came in June 2001. A fake "post-9/11 id check" followed soon after, and the first known attack on a retail bank was reported in September 2003.

  Losses from web banking fraud in the United Kingdom almost doubled in 2005 compared with 2004. In 2006, almost half of phishing thefts were carried out by groups working through the Russian Business Network, based in St. Petersburg. Scam emails posing as the Internal Revenue Service went after American taxpayers. In 2007, 3.6 million adults lost US$3.2 billion to phishing.

  The 2010s brought attacks on much bigger names. In 2011, the master keys for RSA SecurID security tokens were stolen through phishing. In November 2013, a phished subcontractor account exposed 110 million customer and credit card records at Target, and the CEO and IT security staff were later dismissed. In August 2014, fake emails that looked like they came from Apple or Google led to the iCloud leaks of celebrity photos. That November, phishing gave attackers administrative access to ICANN's Centralized Zone Data System.

  Fancy Bear featured repeatedly. It was linked to spear phishing against the Pentagon email system in August 2015, and used a zero-day exploit of Java in an attack on the White House and NATO. In the first quarter of 2016 it targeted addresses tied to the Democratic National Committee. In August 2016 it was suspected in attacks on members of the Bundestag, and the World Anti-Doping Agency reported phishing emails that claimed to be official WADA messages.

  Some attacks were plainly commercial. In August 2017, fake Amazon Prime Day deals led shoppers to enter data on pages that never completed the purchase. In 2018, the company block.one, which developed the EOS.IO blockchain, saw phishing emails sent to all its customers to intercept cryptocurrency wallet keys.

  The 15th of July 2020 brought the most theatrical case. A 17-year-old hacker and accomplices built a fake site that resembled Twitter's internal VPN provider. Posing as helpdesk staff, they phoned several employees and told them to submit their credentials there. That gave them control of high-profile accounts, including those of Barack Obama, Elon Musk, Joe Biden and Apple Inc. The hackers then promised to double any Bitcoin that followers sent, and collected 12.86 BTC, about $117,000 at the time.

  Platforms sold as phishing as a service, such as Darcula, now let attackers fake trusted websites with very little effort.

  3940454870

• 7. Defenses That Fell Short

  ›

  Bank of America once asked customers to choose a personal image, marketed as SiteKey, and showed it beside every password form. Users were told to type their password only when they saw their chosen picture. Studies suggested that few people held back when the image was missing, and the bank has since dropped the feature. Like other forms of two-factor authentication, it also fell to other attacks, such as those suffered by the Scandinavian bank Nordea in late 2005 and Citibank in 2006.

  Other designs tried to fix this. Some institutions display an automatically generated Identity Cue, a colored word inside a colored box. Security skins overlay a user-chosen image on the login form, and the image is shared only between the user and the browser. A dynamic grid of images goes further. The user must pick the pictures that match chosen categories, such as dogs, cars and flowers. Because the grid changes on every attempt, a phishing site would struggle to copy it.

  Filters work at a different level. Specialized spam filters use machine learning and natural language processing to classify phishing mail and reject forged addresses. Browsers check each address in real time against lists of known malicious sites. Google Chrome, Microsoft Edge, Mozilla Firefox, Safari and Opera all include this protection, and some implementations send visited addresses to a central service, which raised privacy concerns. A 2026 study by AV-Comparatives found that Avast Secure Browser and Norton Security Browser blocked 94 percent of phishing addresses, while Google Chrome blocked 72 percent. A DNS service that filters known phishing domains was introduced in mid-2006.

  People remain part of the defense. Security awareness training teaches users to look for requests for information, mismatched emails and addresses, unusual greetings, typos, urgent demands, odd attachments and low-quality graphics. PayPal, for example, always addresses customers by username, so a greeting such as "Dear PayPal customer" signals a likely fake. Yet some studies found that personal details barely change how well phishing works, and people tend not to tell the first and last digits of an account number apart. Research on educational games found they can raise awareness of phishing risk.

  On the monitoring side, digital risk protection companies detect and take down impersonating websites, accounts and apps. Netcraft, ZeroFox and Recorded Future have moved toward automation to match the speed of AI-driven phishing. Individuals can report phishing to groups such as PhishTank, and the Anti-Phishing Working Group publishes regular trend reports. Multi-factor authentication adds another layer, because a stolen password alone can no longer be reused to break into the protected system.

  7576777946

• 8. Courts, Laws and Health Records

  ›

  On the 26th of January 2004, the U.S. Federal Trade Commission filed the first phishing lawsuit. The defendant was a Californian teenager suspected of building a page that mimicked America Online and stole credit card information. Other countries followed. Brazilian police arrested Valdir Paulo de Almeida, a phishing kingpin whose ring stole between US$18 million and US$37 million in two years. In June 2005, UK authorities jailed two men in a case tied to the U.S. Secret Service's Operation Firewall, which targeted notorious carder websites. In 2006, Japanese police arrested eight people for fake Yahoo Japan sites that netted ¥100 million, or US$870,000. The FBI also detained a gang of sixteen in the U.S. and Europe in Operation Cardkeeper.

  Legislators wrote new rules. Senator Patrick Leahy introduced the Anti-Phishing Act of 2005 on the 1st of March 2005. It proposed fines of up to $250,000 and prison terms of up to five years. In the UK, the Fraud Act 2006 created a general offense of fraud punishable by up to ten years in prison. It also banned developing or possessing phishing kits intended for fraud.

  Companies sued too. On the 31st of March 2005, Microsoft filed 117 federal lawsuits in the U.S. District Court for the Western District of Washington against "John Doe" defendants. It announced about 100 more outside the United States in March 2006, and by November 2006 it had begun 129 lawsuits mixing criminal and civil actions. In early 2006, AOL brought three lawsuits seeking a total of US$18 million under the Virginia Computer Crimes Act. Earthlink helped identify six men later charged with phishing fraud in Connecticut.

  In January 2007, Jeffrey Brett Goodin of California became the first defendant convicted by a jury under the CAN-SPAM Act of 2003. He had emailed thousands of AOL users while posing as the company's billing department. He faced a possible 101 years in prison across the CAN-SPAM charge and ten other counts, and was sentenced to 70 months.

  Phishing is also the leading cause of healthcare data breaches in the United States. The Office for Civil Rights at the Department of Health and Human Services consistently names email-based attacks as the most common starting point for breaches reported under HIPAA. The Security Rule already requires workforce training on guarding against malicious software. A December 2024 proposal to overhaul it would mandate multi-factor authentication for all access to electronic protected health information, along with simulated phishing exercises. Regulators were prompted in part by the 2024 Change Healthcare cyberattack, which compromised the records of approximately 100 million people.

  8384858687