Phishing and Social Engineering Attack Reference

Phishing and social engineering represent the most prevalent initial access vector in documented cyber intrusions, exploiting human psychology rather than technical vulnerabilities to extract credentials, funds, or sensitive data. This reference covers the taxonomy of attack types, operational mechanics, common deployment scenarios across regulated sectors, and the decision boundaries used by security teams and incident responders to classify and respond to these threats. Relevant frameworks from NIST, CISA, and the Anti-Phishing Working Group (APWG) inform the classifications used throughout.

Definition and scope

Phishing is a class of deceptive attack in which a threat actor impersonates a trusted entity — a financial institution, technology vendor, government agency, or internal colleague — to induce a target into disclosing credentials, authorizing transactions, or executing malicious code. The Cybersecurity and Infrastructure Security Agency (CISA) identifies phishing as a leading cause of ransomware deployment and business email compromise (BEC) in US organizations.

Social engineering is the broader category. It encompasses any manipulation technique that exploits trust, authority, fear, urgency, or reciprocity to bypass security controls through human action rather than technical exploitation. Phishing is the most automated and scalable social engineering variant; others — vishing, smishing, pretexting, and tailgating — rely on more direct or targeted interaction.

NIST SP 800-63B, published by the National Institute of Standards and Technology, addresses phishing resistance as a core criterion in authenticator assurance levels, distinguishing between phishable credentials (passwords, OTPs) and phishing-resistant authenticators (FIDO2/WebAuthn, PIV cards). This regulatory framing means that in contexts such as CMMC, FedRAMP, and HIPAA, the technical response to phishing intersects directly with mandated authenticator standards.

The scope of phishing extends across sectors. The FBI's Internet Crime Complaint Center (IC3) reported that BEC alone caused over $2.9 billion in adjusted losses in 2023, making it the highest-loss cybercrime category tracked by IC3 that year.

How it works

A phishing attack follows a structured operational sequence. Understanding each phase informs detection strategy and maps directly to the MITRE ATT&CK framework under tactic categories Initial Access (T1566) and Credential Access.

  1. Reconnaissance — The attacker collects target information through open-source intelligence (OSINT): organizational charts, email formats, vendor relationships, and executive names sourced from LinkedIn, public filings, or prior data breaches.
  2. Infrastructure setup — A lookalike domain is registered (e.g., paypa1.com instead of paypal.com), often with a valid TLS certificate to display the padlock icon. Phishing kits — pre-packaged HTML/PHP credential-harvesting templates — are deployed on compromised or purpose-registered hosting.
  3. Lure construction — A pretext is fabricated: a password reset demand, invoice approval request, payroll update, or shipping notification. Spear phishing variants incorporate personalized details from the reconnaissance phase. CISA's Phishing Guidance for Organizations (CISA Fact Sheet, 2023) classifies lures by exploitation of authority, urgency, and fear.
  4. Delivery — The message is sent via email, SMS, voice call, or collaboration platform (Microsoft Teams, Slack). Some campaigns use adversary-in-the-middle (AiTM) proxies that relay authentication in real time, defeating time-based one-time passwords (TOTP).
  5. Exploitation — The target clicks a link, opens an attachment, or verbally discloses credentials. Malicious attachments may deploy malware or ransomware payloads directly.
  6. Post-exploitation — Harvested credentials are used for account takeover, lateral movement, or BEC fraud. Access may be sold on dark web markets or used to persist within the environment.

Common scenarios

Social engineering manifests across distinct attack modalities. The following classifications are drawn from the APWG Phishing Activity Trends taxonomy and NIST SP 800-61r2 incident categories:

Spear phishing vs. bulk phishing — Bulk phishing sends identical lures to thousands of recipients with minimal personalization; conversion rates are low but the volume compensates. Spear phishing targets a specific individual or role using researched context. Whaling is a spear phishing variant directed at C-suite executives or board members. Spear phishing requires greater attacker effort but yields higher-value credentials and is harder to filter with signature-based controls.

Vishing (voice phishing) — Attackers impersonate IT helpdesk personnel, IRS agents, or financial institution fraud teams over telephone. The 2020 Twitter breach, documented in public court records, began with vishing calls to Twitter employees to obtain internal administrative credentials.

Smishing (SMS phishing) — Text messages impersonate delivery services, banks, or government benefit agencies. The FTC's Consumer Sentinel Network tracks smishing as a growing fraud vector, particularly impersonating USPS package notifications.

Pretexting — The attacker constructs an elaborate false identity or scenario over multiple interactions before requesting sensitive information. Pretexting is the primary mechanism in business email compromise, where an attacker impersonates a CFO or vendor over weeks before issuing fraudulent payment instructions.

Quishing (QR code phishing) — Malicious QR codes embedded in email or physical materials redirect targets to credential-harvesting pages, bypassing URL-scanning email gateways that cannot inspect encoded image content.

These scenarios interact with identity and access management controls, security awareness training programs, and incident response frameworks when escalation thresholds are triggered.

Decision boundaries

Security operations centers and incident responders apply defined criteria to classify and prioritize phishing events. The following boundaries determine response tier, regulatory reporting obligation, and escalation path.

Attempted vs. successful phishing — An attempted phishing event is one where the lure was delivered but no credential was submitted and no payload executed. A successful phishing event involves credential submission, payload execution, or unauthorized account access. Regulatory obligations under HIPAA (45 CFR §164.400–414, HHS) and state breach notification laws may trigger only upon confirmed data exposure, not attempted delivery.

Generic phishing vs. targeted campaign — Threat intelligence correlation determines whether an incident is an isolated generic phishing email or part of a coordinated campaign. The threat intelligence function queries indicators of compromise (IOCs) — sender domains, payload hashes, C2 infrastructure — against feeds such as those aggregated through CISA's Automated Indicator Sharing (AIS) program.

Scope of exposure — If harvested credentials belong to a privileged account or service account, the incident is immediately elevated to the security operations center for containment. Credential scope determines whether the response falls under a standard phishing playbook or a full incident response activation, including forensic preservation.

Regulatory sector classification — Healthcare organizations subject to HIPAA, defense contractors under CMMC, and payment card processors under PCI DSS each face sector-specific notification and remediation timelines that begin upon confirming a phishing-related breach. Breach notification laws at the state level impose separate timelines — 30 to 90 days depending on jurisdiction — that run in parallel to federal requirements.

Human-targeted vs. automated-system-targeted — Phishing attacks against service accounts, API tokens embedded in code repositories, or OAuth consent flows are classified differently from employee-targeted lures, and response procedures under vulnerability management frameworks govern the technical remediation path rather than awareness-training intervention alone.

References

📜 2 regulatory citations referenced  ·  🔍 Monitored by ANA Regulatory Watch  ·  View update log

Explore This Site

Regulations & Safety Regulatory References Tools & Calculators Password Strength Calculator