// phishing.lesson

// WHAT IS PHISHING?

Phishing is a social-engineering attack where an adversary impersonates a trusted entity (a bank, a colleague, a cloud service) to trick you into handing over credentials, money, or access.

3.4 billion phishing emails are sent every single day. It remains the most common entry point for data breaches worldwide.

Common variants:

Spear phishing: targeted attack on a specific individual using personal details to appear credible.
Whaling: spear phishing aimed at senior executives (CEOs, CFOs) to authorise large wire transfers or expose strategic data.
Smishing: phishing delivered over SMS ("your package is held, click here").
Vishing: voice phishing via phone call; caller claims to be IT support, a bank, or government.

← BACK

// SENDER SPOOFING

The From: header in an email can be set to anything. A display name of "PayPal Security" means nothing. What matters is the actual sending domain.

✗ PHISHING paypal-security@paypa1-accounts.com

✓ LEGIT security@paypal.com

Tricks attackers use in the domain:

Homoglyphs: replacing l with 1, or o with 0.
Adding words: paypal-security.com is not PayPal.
Subdomain abuse: paypal.com.evil.net; the real domain is evil.net.
Cousin domains: paypa1.com, paypaI.com (capital I).

Tip: Hover over any link before clicking. In a browser, the real destination appears in the status bar. On mobile, long-press to preview.

// URGENCY & FAKE URLs

Phishing emails create artificial pressure to short-circuit your critical thinking. Common urgency phrases:

"Your account will be suspended in 24 hours" · "Immediate action required" · "Unauthorised login detected: verify now"

Once you click, the landing page URL is where the deception lives. Structure tricks:

Subdomain abuse: paypal.com.verify-account.ru/login; real domain is verify-account.ru.
Path confusion: evil.com/paypal.com/login; the path means nothing.
URL shorteners: hide the real destination entirely.
HTTPS ≠ safe: attackers obtain free TLS certificates too. The padlock only means the connection is encrypted, not that the site is legitimate.

// BEC & MALICIOUS ATTACHMENTS

Business Email Compromise (BEC) is a sophisticated attack where criminals impersonate a CEO, CFO, or trusted vendor to trick employees into authorising wire transfers or sharing sensitive data. BEC caused $2.9 billion in losses in the US in 2023 alone (FBI IC3).

Red flags for BEC:

Request for unusual wire transfer or gift cards, often marked urgent and confidential.
The sender's email domain is slightly off (e.g., company-llc.net vs company.com).
Requests to bypass normal approval processes.

Dangerous attachment types:

.lnk: Windows shortcut files; execute arbitrary commands on double-click.
.docm / .xlsm: Office files with macros; macros can run malware.
.iso / .img: disk image files that bypass email filters and mount automatically.
.js: JavaScript files run directly by Windows Script Host.