Definition
Phishing is a cyberattack where malicious actors impersonate trusted entities to deceive individuals into divulging sensitive information or performing harmful actions. These attacks typically leverage social engineering tactics, often through deceptive emails, text messages, or fake websites designed to look legitimate. Attackers aim to steal credentials, install malware, or trick victims into authorizing fraudulent transactions, posing a significant risk to organizational data and finances. For instance, an employee might receive an email appearing to be from HR requesting immediate password updates, leading to account compromise. Unlike broad spam campaigns, targeted phishing attacks like spear phishing are customized to specific individuals or organizations for greater impact. Understanding and defending against phishing is a core competency tested on certifications like CompTIA Security+ and AWS Certified Security Specialty.