Common types of phishing

  • Bulk phishing: the same lure sent to many people, such as a fake parcel delivery notice.
  • Spear phishing: a tailored message aimed at one person or team, often using details found through OSINT.
  • Whaling: spear phishing aimed at senior executives.
  • Smishing and vishing: phishing by SMS and by phone call.
  • Adversary-in-the-middle phishing: a fake login page that relays the real login in real time, capturing passwords and session cookies so some multi-factor authentication can be bypassed.

How phishing works

Most phishing relies on urgency, authority or curiosity: an unpaid invoice, a password expiry warning, a message that appears to come from the chief executive. The message links to a convincing copy of a real login or payment page, often hosted on a lookalike domain, or carries an attachment that installs malware. Stolen credentials are then used for account takeover, fraud or further attacks inside the organisation.

How to reduce phishing risk

  1. Use phishing-resistant multi-factor authentication such as passkeys or FIDO2 security keys.
  2. Set up DMARC, SPF and DKIM so attackers cannot easily send email from your exact domain.
  3. Monitor for lookalike domains and take them down before campaigns start.
  4. Make reporting suspicious messages quick and blame-free.
  5. Agree out-of-band checks for payment and bank detail changes.

How DarkInvader helps

DarkInvader spots the infrastructure behind phishing aimed at your brand: lookalike and typosquatted domains, fake websites and impersonating social accounts. Website Takedowns then removes malicious sites, and Leaked Credentials shows when phished passwords appear online.

Explore Brand Monitoring

Frequently asked questions

What is the difference between phishing and spear phishing?

Phishing is usually sent in bulk with a generic lure. Spear phishing is aimed at a specific person or group and uses personal details to make the message more believable.

Can multi-factor authentication stop phishing?

It stops many attacks, but real-time phishing kits can capture one-time codes and session cookies. Phishing-resistant methods such as passkeys and FIDO2 keys are tied to the real website, so they cannot be replayed on a fake one.

How do I report a phishing email in the UK?

Forward suspicious emails to report@phishing.gov.uk, the NCSC Suspicious Email Reporting Service, and suspicious texts to 7726. Inside your organisation, also follow your own reporting process.

Related terms and reading

Sources