What phishing is
Phishing is an attack on people, not on software. The attacker builds a message that looks like it came from a bank, a colleague, a supplier or the IT department, and asks the reader to do something ordinary: sign in, open a file, pay an invoice or confirm details.
The word is a play on fishing: the message is the bait and the victim's action is the catch.
For an organization, phishing matters because it is one of the most common ways attackers get a first foothold. An outside threat with no access of its own borrows an employee's access, and a single stolen password can start a data breach.
How an attack unfolds
Campaigns differ in scale and polish, but most follow the same four stages, and the last one is where the damage happens: stolen access leads to data exfiltration or to a fraudulent payment.
- 1
Pick a lure
The attacker chooses a believable pretext, such as a password expiry notice, an invoice or a shared document.
- 2
Deliver the message
The message arrives by email, text, phone or a social network, often from a spoofed or lookalike sender.
- 3
Trigger the action
The victim enters a password on a fake page, opens an attachment or approves a request.
- 4
Use the access
The attacker signs in, moves through mailboxes and file shares, and takes data or money.
Main types of phishing
Types differ by channel and by how much the attacker knows about the target. Clone phishing is the variant worth knowing early, because it reuses a message the victim already trusts. QR codes in emails or on posters (quishing) are another carrier for the same trick.
| Type | Channel and target | What sets it apart |
|---|---|---|
| Mass phishing | Email sent to very many recipients | Generic lure, low effort, relies on volume |
| Spear phishing | Email to a chosen person or team | Uses researched details such as name, role, and current projects |
| Whaling | Email to senior executives | Spear phishing aimed at people with wide authority |
| Business email compromise | Email posing as an executive or supplier | Aims to redirect a payment or extract data, often with no link or attachment |
| Smishing and vishing | Text messages and phone calls | The same trick, carried by text or by voice |
| Clone phishing | Email resent from a real one | Copies a message the recipient already trusts and swaps the link or file |
Why it works on people
Phishing works because it exploits habits, not flaws in software. Messages borrow authority (a manager, a bank), create time pressure or look like routine work, and busy people act on routine requests without checking them. When an employee is tricked into handing over a password or a file, the result is a case of inadvertent disclosure: no one meant to leak anything.
Good writing used to be a reliable tell. That advice has weakened, because tools that produce fluent text in any language let attackers remove the awkward phrasing that once gave messages away.
A polished message is not a safe message: judge the request, not the grammar.
Warning signs
No sign is proof, and well-made messages show none of them. Treat the combination and the request itself as the test: does an unexpected message ask for credentials, money or data?
- A sender address that is close to a real one but not the same, such as a swapped letter in the domain
- Urgency or threat: an account about to be closed, a payment due today
- A link whose real destination, visible on hover, differs from its text
- An unexpected attachment, especially an archive, a document asking to enable macros or an executable
- A request to sign in, pay or send data by a route that is not the usual one
- A request for secrecy or to skip the normal approval step
Layers of defense
No single control stops phishing, because each one covers a different stage: the message arriving, the click, the sign-in, and the data leaving. Layers work best when they assume that some messages will get through and aim to keep sensitive data from going with them.
| Control | Scope | What it does |
|---|---|---|
| Awareness trainingPeople who read mail | All staff | Teaches people to verify unexpected requests and report them |
| Multi-factor authenticationAccount sign-in | All accounts | Makes a stolen password less useful; phishing-resistant methods such as security keys and passkeys are the strongest |
| SPF, DKIM, and DMARCSender domain records | Mail domain | Make it harder to spoof the organization's own domain |
| Mail filtering and sandboxingInbound gateway | Inbound mail | Checks links and attachments before delivery |
| Reporting and responseSecurity process | Security team | One-click reporting and a rehearsed way to reset passwords and end sessions |
| Data-loss controlsEndpoint and web channels | Endpoints | Limit what can leave if a mistake still happens |
What it looks like in Anexet
Anexet is not an anti-phishing gateway and does not decide whether a message is phishing.
What it does is email interception on monitored endpoints, which lets the content of messages and attachments be analyzed, and HTTP blocking rules within web traffic monitoring, which can stop a request whose content breaks a policy, such as sensitive data sent to a site. The employee then sees a message like the one below.
Where to start
Start with the accounts and data that would hurt most to lose: mail, finance, and administrator access. Turn on multi-factor authentication there first, then agree on one way to report a suspicious message and one out-of-band check for payment and bank-detail changes.
Treat training as practice, not a yearly lecture: short, specific, and without blame, so people report mistakes quickly instead of hiding them.
Phishing does not break a system. It asks a person to open the door, so the defense has to cover both the person and what is behind the door.
Anexet TeamHow Anexet handles this
Anexet is not an anti-phishing mail gateway: it does not classify senders, inspect URLs, or score messages for phishing intent. Its relevance lies in the mechanics it does have: interception and content analysis of email on monitored endpoints, and control of the data transfers that follow a successful attack.
When an employee is tricked, the aftermath is data movement: files leaving through mail, web, cloud storage or removable media. Anexet's DLP module watches those channels and analyzes the content of what is sent, which makes containment and investigation possible.
Mail interception and content analysis
Endpoint agents capture email traffic, including webmail and mail clients, and analyze message and attachment content against thesauri, hash banks, digital fingerprints and Microsoft sensitivity labels.
Control of data transfers
Security policies watch sensitive content moving through email, web, cloud applications, messaging, printing, clipboard and removable devices, raise incidents and alerts, and blocking rules can stop a transfer, with blocked email held in quarantine.
Audit trail
Intercepted events are recorded with user, computer, time, and channel, giving an attributable trace of what passed through monitored channels and what data left.
Honest boundaries
Stopping the lure from arriving remains the job of mail security, MFA, and training; Anexet adds visibility into endpoint channels and control over the data movement that follows.
Anexet DLP
Learn more