Phishing Attacks Explained: 12 Types of Phishing You Should Know

A phishing attack is a cyberattack in which a malicious actor tricks someone into handing over sensitive information such as credit card details, usernames, and passwords. Because phishing cleverly exploits psychological weak spots by impersonating someone else, and relies on the victim's mistakes rather than on hardware or software flaws, it is considered a type of social engineering attack.

Phishing attacks typically use phishing emails that lure people into entering personal information on fake websites. These emails ask users to reset their password or verify their credit card details, and link to fake websites that look very similar to the real ones. The main types of phishing are clone phishing, spear phishing, and pharming.

Phishing attacks are also common in the crypto ecosystem. Malicious actors use phishing techniques to steal Bitcoin or other digital assets from users. For example, an attacker can spoof a real website and replace the wallet address with their own, making users believe they are using the genuine site, and then intercept their funds.

12 Types of Phishing

There are 12 common types of phishing, classified by their targets and attack vectors. Here are some typical examples.

1. Clone phishing

The attacker takes a previously sent email and sends a near-identical copy containing a link to a malicious site. They then claim the old link has expired and urge the recipient to open the updated or new link.

2. Spear phishing

This usually focuses on a specific person or organization known to others. Spear attacks are more sophisticated than other types of phishing. The attacker first gathers information about the victim (for example, the names of friends or family members), then uses that data to craft a message that convinces the victim to visit a malicious website or download a malicious file.

3. Pharming

In this attack, the attacker poisons DNS records and redirects visitors of a genuine website to a fraudulent site the attacker has prepared in advance. It is the most dangerous attack, because users have no control over DNS records and therefore cannot defend against it.

4. Whaling

A form of spear phishing that targets wealthy and important people, such as CEOs or government officials.

5. Email spoofing

Emails are disguised to look as if they were sent by a legitimate company or person. A phishing email may give unsuspecting victims a link to a malicious site, where the attacker uses a cleverly disguised login page to collect passwords and other information. These pages may contain trojans, keyloggers, and other malicious scripts that steal personal information.

6. Website redirects

Website redirects send users to a different URL from the one they meant to visit. Attackers who exploit vulnerabilities can insert redirects and install malware on users' computers.

7. Typosquatting

Typosquatting directs traffic to fake websites that use foreign-language spellings, common misspellings, or subtle variations of the top-level domain. Phishers use these domains to mimic the interface of a legitimate website and fool users who mistype or misread the URL.

8. Watering hole

In a watering hole attack, the attacker figures out which websites users visit frequently. They then scan those sites for vulnerabilities and inject malicious scripts designed to attack users the next time they visit.

9. Impersonation and giveaways

Impersonating influential figures on social media is another technique used in phishing scams. Phishers can pose as key people at a company and advertise giveaways to large numbers of users. Scammers may hack verified accounts or tweak usernames so they can impersonate the real person while keeping the verified status. Victims who think they are interacting with an influential figure may end up handing over personal information. Recently, phishers have been heavily targeting platforms such as Slack, Discord, and Telegram for the same purpose, spoofing chats, impersonating influencers, and copying real services.

10. Ads

Paid ads are another trick used in phishing. These (fake) ads use domains that the attacker has typosquatted and then paid to place at the top of search results. Such sites may even appear as top results when you search for a legitimate company or service like Binance. They are often used as a way to phish sensitive information, including login details for trading accounts.

11. Malicious applications

Attackers can also use malicious apps as a way to inject malware that monitors user behavior or steals sensitive information. These apps may be disguised as price trackers, wallets, and other crypto-related apps (targeting users who are inclined to trade and hold crypto).

12. Smishing and vishing

A form of phishing based on text messages, and another means attackers use to try to obtain personal information.

Phishing vs. Pharming

Some consider pharming a type of phishing attack, but pharming relies on a different mechanism. The biggest difference between phishing and pharming is that phishing requires the victim to make a mistake, whereas pharming only requires the victim to visit a genuine website whose DNS records the attacker has manipulated.

5 Ways to Prevent Phishing

1. Check the email

The best way to prevent email phishing is to be skeptical of the emails you receive. Were you expecting an email from someone on that topic? Do you suspect the information provided has nothing to do with reality? If in doubt, try contacting the sender through a different channel.

2. Check the content

You can type part of the content (or the sender's email address) into a search engine to see whether there are records of phishing attacks using that particular method.

3. Try another way

If a company you know asks you to verify your account information, don't click the link in the email. Verify it through a different route instead.

4. Check the URL

Without clicking, hover your mouse cursor over the link and check that it starts with HTTPS rather than HTTP. This alone doesn't guarantee the site is legitimate, though, so look closely at the URL for misspellings, unusual characters, and anything else out of the ordinary.

5. Never share your private keys

Never reveal the private keys of your Bitcoin wallet, and judge carefully whether products and sellers are genuine. Unlike with credit cards, a big difference when transacting in crypto is that, due to the nature of blockchain, there is no central authority you can dispute with if you don't receive the promised goods or services. That's why you need to be especially careful when making crypto transactions.

Conclusion

Phishing is one of the most common cyberattack techniques. Email filters from major providers such as Google and Naver are effective at catching spoofed emails, but you still need to stay alert.

Watch out for phishing attempts that try to obtain sensitive or personal information. Make sure the sender is genuine. Also, rather than clicking links in emails, go to the webpage directly, and check carefully that the URL starts with HTTPS. Finally, always keep your private keys and passwords private and never disclose them to anyone.