Phishing

The term dates from the mid-1990s AOL scene, where attackers "fished" for account passwords; the ph spelling echoes phone phreaking. MITRE ATT&CK models it as T1566 Phishing (Initial Access) with sub-techniques .001 Spearphishing Attachment, .002 Spearphishing Link, .003 Spearphishing via Service and .004 Spearphishing Voice, plus T1598 Phishing for Information when the goal is reconnaissance rather than code execution or credential capture.

Email's weakness is that SMTP (RFC 5321) has no built-in sender authentication. Three DNS-published mechanisms retrofit it. SPF (RFC 7208) lets a domain list the IPs allowed to send for its envelope sender (RFC5321.MailFrom), limited to 10 DNS-querying terms per evaluation. DKIM (RFC 6376) adds a signature over selected headers and the body, verifiable with a public key at selector._domainkey.domain. DMARC (RFC 7489) ties them to what the user actually sees: the visible From domain (RFC5322.From) must align with a passing SPF or DKIM domain, and the owner publishes a policy of p=none, p=quarantine or p=reject plus aggregate (rua) reporting. Since February 2024 Google and Yahoo require DMARC for bulk senders. These controls stop exact spoofing of a protected domain only; lookalike domains, display-name spoofing, compromised legitimate accounts and abuse of trusted cloud services pass all three.

Modern credential phishing has largely moved to adversary-in-the-middle kits (Evilginx, EvilProxy and successors). Instead of hosting a static copy of the login page, the kit reverse-proxies the real identity provider in real time, so the victim completes a genuine sign-in including OTP, SMS or push MFA, and the attacker captures the resulting session cookie. Microsoft documented one such campaign in 2022 targeting more than 10,000 organisations. The durable countermeasure is phishing-resistant authentication: FIDO2/WebAuthn passkeys and smart cards bind the cryptographic assertion to the origin the browser actually connected to, so a proxy on a different domain receives nothing usable. Conditional access that requires a managed, compliant device and short session lifetimes reduce the value of stolen cookies further.

Delivery keeps adapting to filters: HTML attachments that assemble the page locally (HTML smuggling), QR codes that move the victim to an unmanaged phone (quishing), links to legitimate file-sharing services, OAuth consent phishing that asks the user to grant a malicious app mailbox scopes, and device-code phishing that abuses the OAuth device authorisation grant (RFC 8628). Detection therefore layers URL rewriting and time-of-click analysis, sandboxing, lookalike-domain monitoring and user reports. Phishing differs from its children by targeting: bulk phishing optimises volume, spear phishing and BEC optimise credibility, and smishing and vishing change the channel.