Phishing

What is phishing?

Phishing is a social engineering attack in which the attacker impersonates a trusted sender to make a person hand over credentials, approve an authentication request, transfer money or open a malicious file. The BSI describes it as the starting point of a wide range of crimes, from account takeover to attacks on critical infrastructure. NIST defines it as deceiving individuals into disclosing sensitive personal information through fraudulent communication that appears to be legitimate.

The medium varies, the pattern does not: a plausible pretext, time pressure and a link or attachment. Variants are named after the channel: spear phishing is targeted at one person or role, smishing uses SMS, vishing uses phone calls, often with cloned voices, and quishing hides the link in a QR code so that mail filters cannot read it.

Where is it defined?

There is no legal definition of phishing. German criminal law covers it through general provisions, in particular fraud (§ 263 StGB) and data espionage (§ 202a StGB). Regulation addresses it from the defender’s side: NIS2 lists basic cyber hygiene practices and cybersecurity training (Article 21(2)(g)) and multi-factor authentication (Article 21(2)(j)) among the mandatory measures for essential and important entities. NIST SP 800-63B defines what makes an authenticator phishing resistant: the authenticator cryptographically binds the login to the verifier’s real domain, which is what FIDO2 and passkeys do and what one-time codes cannot.

What it means in practice

Phishing is the most frequent way into a company that we see in incident analyses, and the realistic opening move in a red team engagement. Three observations from that work:

• The click is not the failure, the architecture is. People will click. The question is what a stolen password or an approved push prompt gives the attacker. With single sign-on and legacy protocols that still accept passwords alone, it is often the whole company.
• One-time codes are no longer a barrier. Adversary-in-the-middle kits sit between user and real login page and forward the code within seconds. The defence that holds is FIDO2 hardware keys or passkeys for every account that matters, starting with administrators, developers and finance.
• Detection after the click decides the outcome. A login from a new country, a mailbox rule that forwards everything, an OAuth app that suddenly has mail access: these are the signals a SOC should alert on within minutes. Zyberdome, our managed SOC, is built around exactly this kind of identity telemetry.

For manufacturers of connected products the exposed accounts are different: code signing, update servers, cloud consoles and device management. Treat them as production infrastructure, not as office IT.

Common misunderstandings

Awareness training reduces click rates but does not get them to zero, and a programme that shames individuals teaches people to hide incidents instead of reporting them. Spam filters catch the bulk, not the targeted message that was written for one person. And phishing is not a problem of large companies: small firms are hit as often, with fewer people to notice.