What is phishing?

Phishing is a social engineering attack where someone poses as a trusted person or organization to trick a target into handing over credentials, financial information, or access. It's carried out over email, text message, phone calls, and increasingly social media, and it remains the entry point for a large share of the intrusions that follow. Unlike attacks that exploit a technical flaw, phishing exploits a person's trust and attention, which is why it stays effective even as technical defenses improve. This page covers how phishing attacks work, the main variants in use, and how organizations detect and respond to the compromise that follows a successful attempt.

Key takeaways

Phishing is a form of social engineering, not a technical exploit. It manipulates a person into taking an action rather than breaking a system directly.
Spear phishing, whaling, smishing, and vishing are targeted variants that adapt the same trick to a specific person, channel, or level of seniority.
Business email compromise (BEC) uses phishing to impersonate an executive or vendor and redirect a real payment, often without any malware involved at all.
Generative AI has removed the old red flags. Poor grammar and awkward phrasing, once reliable tells, are far less common in current phishing attempts.
Security awareness training reduces risk but doesn't eliminate it. Detecting what happens after a click matters just as much as stopping the click itself.

How does a phishing attack work?

A phishing attack starts with research. Attackers gather whatever public information they can find about a target, whether that's a company directory, a LinkedIn profile, or a previous data breach, to make an impersonation convincing. The more specific the details, the more the message reads as legitimate.

The message itself impersonates someone the target trusts: a colleague, an executive, a bank, or a well-known brand. It creates urgency (an overdue invoice, a suspended account, a security alert) so the target acts before thinking to verify the source. From there, the attack asks for one of two things: a click that leads somewhere malicious, or a reply that hands over money or information directly.

If the target clicks, they typically land on a spoofed login page that captures whatever credentials they enter, or the click triggers a malicious download that installs malware on the device. If the message asks for a reply instead, as in a business email compromise attempt, the entire attack can succeed without any malicious file or link at all; it's simply a convincing request that gets acted on.

Types of phishing attacks

Phishing attacks vary by channel and by how narrowly they target a specific person, but the underlying trick is always the same: impersonate someone trusted and create a reason to act quickly.

Types of phishing attacks
Type	What it does	Distinguishing trait
Email phishing	Mass emails impersonating a known brand or service, sent to as many recipients as possible.	Low personalization. It relies on volume rather than targeting.
Spear phishing	Targeted emails aimed at a specific person, using research to add convincing personal detail.	Requires reconnaissance on the target and has a much higher success rate than bulk email phishing.
Whaling	Spear phishing aimed at executives or other high-value, high-privilege targets.	Often skips malicious links in favor of a highly personalized request.
Business email compromise (BEC)	Impersonates an executive or vendor to redirect a payment or request sensitive data.	Frequently involves no malware or link at all, just a convincing message.
Smishing	Phishing conducted over SMS text message.	Exploits the quick, low-scrutiny way people read text messages.
Vishing	Phishing conducted over a phone call, often using a spoofed caller ID.	Increasingly uses AI voice cloning to impersonate a specific, trusted individual.
Clone phishing	Duplicates a previously delivered, legitimate email and swaps in a malicious link or attachment.	Exploits trust already established by the original message.
Angler phishing	Uses fake customer-support social media accounts to intercept and exploit real complaints.	Targets users who first reach out to a brand’s real social media presence.

Signs of a phishing attempt

A sense of urgency or a threat of consequences if the recipient doesn't act immediately.
A sender address or domain that looks almost right but isn't quite an exact match.
A generic greeting instead of the specific details a legitimate sender would normally include.
An unexpected attachment or a request to enable macros or editing in a document.
A link that, when hovered over, points somewhere different from what the visible text suggests.
A request for credentials, payment details, or a wire transfer that wasn't expected.
An unusual request framed as routine, such as an IT team asking for a password over email.

Why phishing works even when people are trained to spot it

Phishing succeeds by targeting attention and emotion rather than a technical control, which is why training alone caps but doesn't eliminate the risk. A message built around urgency or fear pushes people to act before they'd normally stop to verify a source, and a single successful click across a large organization is often enough to start a broader compromise. Generative AI has removed much of what used to make phishing easy to spot: grammatical errors, awkward phrasing, and generic mass-market templates are far less common in current attempts, and voice cloning has made vishing calls convincing enough to fool people who would never fall for a text-based scam.

This is also why phishing rarely stays a standalone incident. It's most often the first step in a longer chain: a stolen credential that leads to account takeover, a malicious attachment that installs malware, or a BEC message that becomes a fraudulent wire transfer. Stopping the initial message matters, but so does catching what happens in the minutes and hours after someone clicks.

How a SOC detects and responds to phishing

Sekoia's agentic SOC platform isn't an email security gateway, so it isn't positioned to filter phishing messages out of an inbox before delivery. Its role starts where email filtering leaves off: detecting and responding to what happens once a phishing attempt turns into an actual compromise. That means correlating identity telemetry (an unusual login location or time following a credential entry), endpoint behavior (a suspicious process launched from a downloaded attachment), and network activity (a connection to newly registered, low-reputation infrastructure) through SIEM and XDR rather than relying on any single signal.

Threat intelligence adds useful context here: phishing infrastructure is frequently reused across campaigns, so a domain, sender pattern, or kit fingerprint linked to a known campaign helps a SOC triage a reported email faster and anticipate what else that campaign might be targeting. When a user reports a suspicious message, the value is in how quickly that report gets correlated against everything else happening across the environment, not just whether the single email gets quarantined.

How to reduce phishing risk

Deploy email filtering that inspects links and attachments rather than relying on sender reputation alone.
Require multi-factor authentication everywhere, since it blocks most account takeovers even after a password is phished.
Run regular, realistic security awareness training and phishing simulations rather than a single annual session.
Establish a verification channel for financial requests, so a wire transfer request always gets confirmed outside of email.
Implement DMARC, SPF, and DKIM to make it harder for attackers to spoof your own domain convincingly.
Give employees an easy, low-friction way to report suspicious messages, and act on those reports quickly.
Deploy endpoint detection and response to catch what a phishing email delivers, not just the email itself.

Why multi-factor authentication isn't a complete answer to phishing

MFA blocks the large majority of account takeover attempts that follow a phished password, which makes it one of the highest-value controls an organization can deploy. But it isn't absolute. MFA-bypass frameworks now intercept session tokens in real time, effectively phishing the second factor along with the first, and prompt-fatigue attacks simply bombard a user with approval requests until one gets accepted out of frustration or habit. The practical implication is that MFA should be treated as a strong layer, not a finish line. The accounts and sessions it protects still need to be watched for the unusual behavior that shows up after a token has actually been intercepted.

Phishing FAQs

What is the difference between phishing and spear phishing?

Phishing is the general term for any fraudulent message designed to steal information or trick someone into an action. Spear phishing is a targeted subset aimed at one specific person or organization, using researched details (a name, a job title, a recent event) to make the message far more convincing than a generic, mass-sent attempt.

What is whaling in cybersecurity?

Whaling is spear phishing aimed specifically at executives or other senior, high-privilege targets. Because senior employees often have significant public information available about them, attackers can craft highly personalized messages, and whaling attempts frequently skip malicious links entirely in favor of a convincing, urgent request such as an executive asking for a wire transfer.

‍

Can multi-factor authentication stop phishing attacks?

MFA stops most account takeovers that would otherwise follow a phished password, since a stolen password alone isn't enough to log in. It isn't foolproof: MFA-bypass techniques can intercept session tokens, and prompt-fatigue attacks push a user into approving a login they didn't initiate. MFA significantly reduces risk but works best alongside monitoring for unusual account activity.

What is business email compromise (BEC)?

Business email compromise is a phishing variant that impersonates an executive, colleague, or vendor to redirect a payment or extract sensitive information. Unlike most phishing, BEC frequently involves no malware or malicious link at all. The entire attack can be a single, well-timed, convincing email that asks for something the recipient believes is a routine request.

How has AI changed phishing attacks?

Generative AI has removed many of the traditional red flags of phishing: poor grammar, awkward phrasing, and generic templates are far less common now that attackers can generate polished, personalized messages at scale. AI voice cloning has also made vishing calls convincing enough to impersonate a specific person after only a short sample of their voice, which has expanded phishing well beyond email and text.

What should someone do if they click a phishing link?

Disconnect the device from the network, change any passwords that may have been entered on the resulting page, and enable multi-factor authentication if it wasn't already active. Report the incident to IT or the security team immediately rather than investigating it alone, since a compromised account or device needs to be checked for further activity, not just a changed password.