PATCH//NOTES Open the interactive version
← All lessons
Threats · Beginner · 4 min

Phishing & social engineering

Most breaches start with a message, not a hack.

What it is

Phishing is tricking someone into clicking a link, opening a file, handing over a password or sending money by pretending to be someone they trust. Social engineering is the wider skill of manipulating people: fake IT support calls (vishing), texts (smishing), or emails that impersonate the boss asking for an urgent payment (business email compromise). Attackers lean on urgency, authority and fear because people under pressure skip the checks they'd normally do.

See it: How a credential-phishing attack unfolds

  1. Attacker → Employee: Email: “Your mailbox is full. Sign in to keep it.”. The email looks like it comes from IT and adds urgency so the reader acts before thinking. Stopped by: Email filtering and SPF, DKIM and DMARC catch many spoofed senders.
  2. Employee → Fake login page: Clicks the link and types a password. The link opens a copy of the real sign-in page on a lookalike address. Stopped by: Check the address; report it. Never punish people who click.
  3. Fake login page → Attacker: Password sent to the attacker. Whatever is typed into the fake page goes straight to the attacker.
  4. Attacker → Real email account: Signs in as the employee. With the password, the attacker logs in to the real account to read mail or phish colleagues from a trusted address. Stopped by: Phishing-resistant MFA (passkeys) blocks this step: the password alone isn't enough.

Step through the animated diagram in the app.

Real case · 2023

MGM Resorts (Scattered Spider)

Attackers found an employee on LinkedIn, called the IT help desk pretending to be them, and talked staff into resetting their login. That one phone call led to ransomware that shut down hotel systems and cost MGM about $100 million.

Source: Wikipedia: Scattered Spider

How defenders stop it

  • Phishing-resistant MFA (passkeys or security keys) so a stolen password isn't enough
  • Verify unusual requests through a second channel you already trust
  • Make reporting easy and never punish people for clicking
  • Email filtering plus SPF, DKIM and DMARC to block spoofed senders

Try it yourself

Take Google's phishing quiz

Check yourself

1. Your 'CEO' emails asking you to buy gift cards urgently and keep it quiet. What's the best move?

  1. Buy them quickly, it's the CEO
  2. Reply to the email to ask if it's real
  3. Contact the CEO through a known phone number or chat
  4. Forward it to colleagues to see what they think
Show answer

Contact the CEO through a known phone number or chat. Replying goes straight back to the attacker. Verify through a channel you already trust.

2. An email says your account will be closed within the hour unless you sign in now. Which trick is it mainly relying on?

  1. Credential stuffing
  2. Encryption
  3. Urgency
  4. A zero-day
Show answer

Urgency. Attackers lean on urgency, authority and fear because people under pressure skip the checks they'd normally do.

3. You typed your password into a fake login page. Which defence still stops the attacker getting in?

  1. A longer password
  2. Clearing your browser history
  3. Antivirus on your phone
  4. Phishing-resistant MFA such as a passkey or security key
Show answer

Phishing-resistant MFA such as a passkey or security key. A passkey or security key only works on the real website, so a stolen password on its own isn't enough.

Answer them in the app to earn XP.

Next: Ransomware →