Phishing
Definition
Social engineering technique where the attacker impersonates a trusted identity (bank, support, colleague) to steal credentials, OTPs, money, or trigger malware execution.
Variants by vector: email (classic), smishing (SMS), vishing (voice, now with AI voice cloning), quishing (QR), spear phishing (targeted at a specific person via OSINT).
Variants by objective: credential phishing (fake login form), MFA fatigue / push bombing (2FA push spam until the user accepts), session token theft (AitM — Adversary-in-the-Middle like Evilginx2 capturing post-2FA sessions), BEC (Business Email Compromise — diverting wire transfers).
Defence: strict DMARC + DKIM + SPF on your domains, phishing-resistant MFA (FIDO2 / passkeys — NOT TOTP), email security gateway with sandboxing, training focused on BEC and MFA fatigue (not just the badly-written-email classic), realistic simulations.