{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/phishing","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/phishing/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/phishing/"},"term":{"en":"Phishing","da":"Phishing"},"aka":{"en":["phishing attack"],"da":["phishing-angreb"]},"domain":["security"],"cluster":"awareness","layer":"people","status":"current","era":1995,"summary":{"en":"Fake emails or messages sent in bulk to trick people into handing over information or clicking something harmful.","da":"Falske mails eller beskeder sendt i stor mængde for at narre folk til at udlevere oplysninger eller klikke på noget skadeligt."},"body":{"formal":{"en":"A form of social engineering in which messages pretending to come from a trusted sender are sent to many people, aiming to capture a password or other credential, or to get the reader to open a harmful file or link.","da":"En form for social engineering, hvor beskeder, der udgiver sig for at komme fra en betroet afsender, sendes til mange mennesker for at opsnappe en adgangskode eller anden loginoplysning eller få modtageren til at åbne en skadelig fil eller et skadeligt link."},"plain":{"en":"Like casting a net with bait into the sea - the sender does not care which fish bites, only that some do.","da":"Som at kaste et net med madding i havet - afsenderen er ligeglad med, hvilken fisk der bider, bare nogle gør."},"inPractice":{"en":"Hundreds of employees in a region receive a mail “from MitID” saying their login is about to expire; a few follow the link to a copy of the login page and type in their details.","da":"Hundredvis af medarbejdere i en region får en mail “fra MitID” om, at deres login snart udløber; nogle få følger linket til en kopi af login-siden og indtaster deres oplysninger."},"whyItMatters":{"en":"It is cheap to send and needs only one person to fall for it, which makes it one of the most common first steps in an attack.","da":"Det er billigt at sende og kræver kun, at én person hopper på det, hvilket gør det til et af de mest almindelige første skridt i et angreb."}},"deepDive":{"en":"The term dates from the mid-1990s AOL scene, where attackers \"fished\" for account passwords; the ph spelling echoes phone phreaking. MITRE ATT&CK models it as T1566 Phishing (Initial Access) with sub-techniques .001 Spearphishing Attachment, .002 Spearphishing Link, .003 Spearphishing via Service and .004 Spearphishing Voice, plus T1598 Phishing for Information when the goal is reconnaissance rather than code execution or credential capture.\n\nEmail's weakness is that SMTP (RFC 5321) has no built-in sender authentication. Three DNS-published mechanisms retrofit it. SPF (RFC 7208) lets a domain list the IPs allowed to send for its envelope sender (RFC5321.MailFrom), limited to 10 DNS-querying terms per evaluation. DKIM (RFC 6376) adds a signature over selected headers and the body, verifiable with a public key at selector._domainkey.domain. DMARC (RFC 7489) ties them to what the user actually sees: the visible From domain (RFC5322.From) must align with a passing SPF or DKIM domain, and the owner publishes a policy of p=none, p=quarantine or p=reject plus aggregate (rua) reporting. Since February 2024 Google and Yahoo require DMARC for bulk senders. These controls stop exact spoofing of a protected domain only; lookalike domains, display-name spoofing, compromised legitimate accounts and abuse of trusted cloud services pass all three.\n\nModern credential phishing has largely moved to adversary-in-the-middle kits (Evilginx, EvilProxy and successors). Instead of hosting a static copy of the login page, the kit reverse-proxies the real identity provider in real time, so the victim completes a genuine sign-in including OTP, SMS or push MFA, and the attacker captures the resulting session cookie. Microsoft documented one such campaign in 2022 targeting more than 10,000 organisations. The durable countermeasure is phishing-resistant authentication: FIDO2/WebAuthn passkeys and smart cards bind the cryptographic assertion to the origin the browser actually connected to, so a proxy on a different domain receives nothing usable. Conditional access that requires a managed, compliant device and short session lifetimes reduce the value of stolen cookies further.\n\nDelivery keeps adapting to filters: HTML attachments that assemble the page locally (HTML smuggling), QR codes that move the victim to an unmanaged phone (quishing), links to legitimate file-sharing services, OAuth consent phishing that asks the user to grant a malicious app mailbox scopes, and device-code phishing that abuses the OAuth device authorisation grant (RFC 8628). Detection therefore layers URL rewriting and time-of-click analysis, sandboxing, lookalike-domain monitoring and user reports. Phishing differs from its children by targeting: bulk phishing optimises volume, spear phishing and BEC optimise credibility, and smishing and vishing change the channel.","da":"Begrebet stammer fra AOL-miljøet i midten af 1990'erne, hvor angribere \"fiskede\" efter adgangskoder; stavemåden med ph nikker til phone phreaking. MITRE ATT&CK beskriver det som T1566 Phishing (Initial Access) med underteknikkerne .001 Spearphishing Attachment, .002 Spearphishing Link, .003 Spearphishing via Service og .004 Spearphishing Voice samt T1598 Phishing for Information, når målet er rekognoscering frem for kodeafvikling eller at opsnappe loginoplysninger.\n\nMailens svaghed er, at SMTP (RFC 5321) ikke har indbygget afsendergodkendelse. Tre mekanismer, der publiceres i DNS, eftermonterer den. SPF (RFC 7208) lader et domæne angive de IP-adresser, der må sende på vegne af dets envelope-afsender (RFC5321.MailFrom), begrænset til 10 DNS-opslag pr. evaluering. DKIM (RFC 6376) tilføjer en signatur over udvalgte headere og selve indholdet, som kan verificeres med en offentlig nøgle under selector._domainkey.domæne. DMARC (RFC 7489) kobler dem til det, brugeren faktisk ser: Det synlige From-domæne (RFC5322.From) skal stemme overens (alignment) med et SPF- eller DKIM-domæne, der er godkendt, og ejeren publicerer en politik med p=none, p=quarantine eller p=reject samt samlede rapporter (rua). Siden februar 2024 har Google og Yahoo krævet DMARC af masseafsendere. Kontrollerne stopper kun forfalskning af præcis det beskyttede domæne; lookalike-domæner, forfalskede visningsnavne, kompromitterede legitime konti og misbrug af betroede cloudtjenester består alle tre.\n\nModerne phishing efter loginoplysninger er i vid udstrækning gået over til adversary-in-the-middle-kits (Evilginx, EvilProxy og deres efterfølgere). I stedet for en statisk kopi af login-siden fungerer kittet som omvendt proxy mod den rigtige identitetsudbyder i realtid, så offeret gennemfører et ægte login inklusive engangskode, sms- eller push-MFA, mens angriberen opsnapper den sessionscookie, der kommer ud af det. Microsoft dokumenterede i 2022 en sådan kampagne rettet mod over 10.000 organisationer. Det holdbare modtræk er phishing-resistent godkendelse: FIDO2/WebAuthn-passkeys og smartcards binder den kryptografiske signatur til det domæne, browseren faktisk er forbundet til, så en proxy på et andet domæne ikke får noget brugbart. Betingede adgangsregler med krav om administrerede enheder og korte sessionslevetider mindsker værdien af stjålne cookies yderligere.\n\nLeveringen tilpasser sig hele tiden filtrene: HTML-vedhæftninger, der samler siden lokalt (HTML smuggling), QR-koder, der flytter offeret over på en uadministreret telefon (quishing), links til legitime fildelingstjenester, OAuth-consent-phishing, hvor brugeren bedes give en ondsindet app adgang til postkassen, og device-code-phishing, der misbruger OAuth-flowet for enhedsgodkendelse (RFC 8628). Detektion kombinerer derfor omskrivning af URL'er med analyse på kliktidspunktet, sandboxing, overvågning af lookalike-domæner og meldinger fra brugerne. Phishing adskiller sig fra sine undertyper ved målretningen: Masse-phishing optimerer på mængde, spear phishing og direktørsvindel på troværdighed, og smishing og vishing skifter kanal."},"edges":[{"type":"requires","to":"cs/credential","confidence":"high","strength":"normal"},{"type":"kind-of","to":"security/social-engineering","confidence":"high","strength":"normal"},{"type":"contrasts-with","to":"security/pretexting","confidence":"high","strength":"normal"},{"type":"causes","to":"security/ransomware","why":{"en":"A harmful attachment or link in a phishing email is a common way ransomware gets its first foothold.","da":"En skadelig vedhæftning eller et link i en phishing-mail er en almindelig vej ind for ransomware."},"confidence":"medium","strength":"normal"},{"type":"causes","to":"security/data-breach","why":{"en":"A captured password lets the attacker log in and reach data as if they were the victim.","da":"En opsnappet adgangskode lader angriberen logge ind og få adgang til data, som om vedkommende var offeret."},"confidence":"high","strength":"normal"}],"depth":2,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"NIST Glossary - Phishing","url":"https://csrc.nist.gov/glossary/term/phishing","tier":"standard","publisher":"NIST"}],"draft":true}