Phishing is when attackers impersonate trusted entities to trick you into revealing information.
Phishing is the most common initial access method used by attackers. The basic flow is simple: send convincing bait (usually an email), lead the victim to a hook (a fake login page that looks identical to the real one), and steal the credentials they enter.
Phishing is delivered through multiple channels. Email phishing is most common. Smishing uses SMS text messages ("Your package is delayed — click here"). Vishing uses phone calls where an attacker impersonates a bank representative or IT support. Each channel exploits different trust signals.
Mass phishing campaigns cast a wide net — the same email goes to millions of addresses hoping a small percentage click. Spear phishing invests research into a specific target. Both are dangerous; spear phishing is more likely to succeed because it exploits genuine familiarity.
The psychological triggers phishing exploits are consistent: urgency ("Act now or your account will be closed"), fear ("Suspicious activity detected"), authority (impersonating a CEO or bank), and curiosity ("You have a package waiting"). Slowing down when any of these appear is your best defense.