Phishing is a social engineering technique in which attackers send deceptive messages, often posing as trusted entities, to make targets click malicious links, download malware, or reveal sensitive information. It targets human behavior rather than software vulnerabilities. section 11.2.2
Recognize these common phishing forms:
- Spear phishing targets employees of a particular company with more focused deception. section 11.2.2
- Whaling targets high-profile individuals, such as company executives. section 11.2.2
- Smishing uses SMS text messages, while vishing uses telephone calls. section 11.2.2
Typical phishing message
A deceptive email appears to come from a trusted organization and urges the recipient to follow a link, download a file, or submit sensitive information. Awareness programs can use false phishing emails to help employees recognize and respond to such threats. section 11.2.2 section 11.6
