Phishing
noun · MITRE ATT&CK T1566
A message that impersonates someone trustworthy to trick the recipient into clicking a link, opening a file, sharing credentials or sending money.
Phishing is the most common way attacks begin. The attacker sends a message, usually an email but also SMS (smishing), chat or a phone call (vishing), pretending to be a bank, a colleague, a delivery company or the IT department. The goal is to make the recipient do something they would not do if they knew who was really asking: enter a password on a fake page, open a malicious attachment, approve a payment or install remote access software.
Good phishing relies on urgency and familiarity, not on technical sophistication. "Your mailbox is full", "invoice overdue" and "your password expires today" work because they look like ordinary work.
Example
An email that appears to come from Microsoft 365 says a document has been shared with you. The link leads to a page that looks exactly like the Microsoft sign-in, hosted on a lookalike domain. Anyone who types their password there has handed it to the attacker, and if the page relays the sign-in in real time, their session cookie too.
Why it matters for a SOC analyst
User-reported phishing is one of the most frequent alerts in a SOC. When you triage one, check the sender's real address and authentication results (SPF, DKIM, DMARC), the destination of every link, and above all who else received it and who clicked. A single click followed by a sign-in from an unfamiliar location turns a phishing report into an account compromise investigation.
Articles that use this term
Threat Analysis · · 4 min read
MFA fatigue attacks: how push bombing works and how to stop it
Why attackers flood users with MFA prompts until one gets approved, what the Uber and Cisco breaches teach us, and the controls that make push bombing fail.
Related terms
- Spear phishing
Phishing aimed at a specific person or small group, using details about them to make the message credible enough to bypass suspicion.
- Business email compromise
Fraud in which an attacker impersonates or takes over a trusted business email account to redirect payments or obtain sensitive data.
- Social engineering
Manipulating people, rather than systems, into giving up information, access or money by exploiting trust, urgency, authority or helpfulness.
- Adversary-in-the-middle phishing
Phishing that relays the victim's sign-in to the real site through an attacker's proxy, stealing the session cookie after MFA succeeds.