Key takeaways
- Phishing is a social-engineering technique: an attacker sends a deceptive message to trick someone into handing over credentials, running malicious code or approving a fraudulent action. MITRE ATT&CK catalogues it as technique T1566 under the initial access tactic.
- Phishing and spoofing were the single most reported cybercrime category in the United States in 2025, with 191,561 complaints, according to the FBI Internet Crime Complaint Center.
- Phishing was a factor in 16 percent of breaches in the Verizon 2026 Data Breach Investigations Report, while the broader human element was present in 62 percent of breaches.
- APWG recorded 3.8 million phishing attacks worldwide in 2025, up slightly from 3.76 million in 2024.
- Phishing is increasingly moving onto mobile devices through voice phishing (vishing), SMS phishing (smishing), and QR-code phishing (quishing). These channels can move an interaction beyond email security controls. Verizon found that mobile-based phishing simulations had a 40 percent higher median click rate than email simulations.
What is phishing? Definition and core mechanics
Phishing is a form of social engineering. An attacker sends a fraudulent message, most often by email but increasingly by text, voice call, or QR code, to trick the recipient into taking an action that gives the attacker access. The recipient may enter credentials into a fake login page, open a malicious attachment, select a link that downloads malware, or approve a payment or account change. MITRE ATT&CK defines phishing as technique T1566 and treats its forms as electronically delivered social engineering.
It runs on two levers: impersonation and urgency. The attacker poses as a trusted sender, a bank, an employer, a government agency, a colleague or a well-known brand, and invents a reason the target has to act right away: a locked account, an overdue invoice, a security alert. Increasingly, phishing pairs this with adversary-in-the-middle (AiTM) infrastructure. ENISA documents campaigns such as FlowerStorm that used AiTM setups mimicking Microsoft 365 login pages to relay sessions and get around MFA. It helps to think of phishing as an entry point rather than the whole scam: the message just gets the attacker in the door, and what happens next, stolen credentials, malware, fraud, is the actual objective.
How does a phishing attack work?
A modern phishing attack typically unfolds in five stages, from researching the target to what happens after the compromise. The table below maps each stage to the attacker's goal and the impact on the business.
Phishing by the numbers: key statistics (2025 to 2026)
Recent reports show the scale of phishing complaints, attacks, and breach involvement, while also highlighting important differences in how each source measures the threat.
Two of these figures deserve context. Verizon's 16 percent is best read as a floor rather than a ceiling: its taxonomy files voice phishing under pretexting and browser-based credential harvesting under baiting, so the real share of breaches involving credential-harvesting social engineering runs higher than the headline number suggests. The ENISA figure is different in kind. More than 80 percent is a vendor-reported estimate of AI-supported phishing rather than a measured count, which makes it a useful indicator of where phishing is heading rather than a precise measure of scale.
What are the main types of phishing?
Phishing is an umbrella term covering several variants that mostly differ by delivery channel and targeting. The most common:
- Email phishing: broad, high-volume campaigns sent to many recipients, impersonating trusted brands or institutions. This is the baseline form of phishing delivery.
- Spear phishing: highly targeted phishing aimed at one person or organization, using tailored details to seem credible. Business email compromise (BEC), which drove $3.05 billion in reported U.S. losses in 2025, often starts with spearphishing but is its own fraud category, built around trusted communications and unauthorized transfers or data disclosure.
- Whaling: spear phishing that specifically targets senior executives, whose access and authority make them high-value targets.
- Vishing (voice phishing): phishing carried out by phone call or voicemail, often layered into a broader telephone-based attack.
- Smishing (SMS phishing): phishing delivered by text message. It's a fast-growing channel because it reaches personal mobile devices directly and skips email filters entirely.
- Quishing (QR-code phishing): phishing that hides a malicious URL inside a QR code, pushing the target onto a mobile device that's often outside enterprise security controls. MITRE tracks this as T1660 in Mobile ATT&CK, not Enterprise ATT&CK.
- ClickFix and FileFix: social-engineering techniques that trick users into pasting and running attacker commands themselves. Phishing is a primary delivery vector for both.
Which threat actors use phishing?
Phishing shows up across the full threat-actor spectrum, from financially motivated cybercriminals to state-sponsored espionage groups. Each of the groups below has a documented reliance on phishing recorded in government advisories or vendor threat research.
How does phishing map to MITRE ATT&CK?
MITRE ATT&CK catalogues phishing as technique T1566 under the initial access tactic, with four sub-techniques based on delivery mechanism. The related technique T1598, Phishing for Information, covers attempts to elicit information without delivering a payload. The table below lists the phishing technique family and techniques commonly chained with it.
Why are MSPs at elevated risk from phishing?
MSPs can face concentrated phishing risk because a compromised privileged technician account may expose administrative access to multiple client environments. Management consoles, remote monitoring and management platforms, and professional services automation tools centralize access across the client base. Attackers also target help-desk identity workflows to obtain credential or MFA resets. If a central management account is compromised, the attacker may be able to reach multiple connected environments.
Four mitigations, mapped to attack phases:
- Enforce MFA on all management portals (stages 3 and 4). Hardware keys or passkeys resist the adversary-in-the-middle token theft that defeats one-time-code MFA.
- Harden and monitor help-desk identity-verification workflows (stage 3). Require out-of-band verification before any credential or MFA reset, and monitor reset activity for signs of abuse.
- Deploy layered email and web filtering that inspects QR codes and links (stages 2 and 3). Quishing can evade text-centric email filters and traditional URL-inspection workflows, so controls must account for image-based and mobile-redirected lures.
- Segment management infrastructure from client production networks (stage 5). If the management plane is reachable from a compromised client environment, one phished tenant can cascade to the console and the wider client book.
How does Acronis protect against phishing?
Acronis addresses phishing across four layers: prevention, user awareness, detection and recovery. The table below maps each stage of the attack lifecycle to the risk, the capability needed to address it and the corresponding Acronis response.
Frequently asked questions about phishing
What is phishing in simple terms?
Phishing is a deceptive message designed to make someone reveal information, run malicious code, or approve a fraudulent action.
What is the difference between phishing, spear phishing and whaling?
Phishing is broad; spear phishing targets a specific person or organization; whaling targets senior executives.
How is phishing different from vishing, smishing and quishing?
Vishing uses voice calls, smishing uses SMS, and quishing uses QR codes.
How does phishing bypass multifactor authentication?
Modern phishing often uses adversary-in-the-middle infrastructure, a proxy that sits between the victim and the real login page. When the victim enters their password and completes the MFA challenge, the proxy relays it to the legitimate site and captures the resulting authenticated session token. The attacker then reuses that token to access the account without needing the password or a fresh MFA code. This is why phishing-resistant MFA, such as hardware security keys and passkeys, is more effective than one-time codes sent by app or SMS.
What are the warning signs of a phishing message?
Common warning signs include an unexpected sense of urgency or threat, a request for credentials, payment or sensitive data, a sender address or URL that looks almost but not quite correct, generic greetings, and links or QR codes you were not expecting. Be especially cautious with messages that ask you to scan a QR code or move the conversation to a phone call or personal device. When in doubt, verify through a separate, known channel rather than replying or clicking.
How common is phishing?
Phishing is one of the most common cyberthreats. In the United States, phishing and spoofing were the single most reported cybercrime category in 2025, with 191,561 complaints to the FBI Internet Crime Complaint Center. Globally, the Anti-Phishing Working Group recorded 3.8 million phishing attacks in 2025. Phishing was a factor in 16 percent of breaches in the Verizon 2026 Data Breach Investigations Report, and the broader human element, which includes phishing and social engineering, appeared in 62 percent of breaches.
What should I do if I clicked a phishing link or entered my credentials?
Act quickly. Change the password for the affected account and any other account that used the same password, and enable or reset multifactor authentication. If it was a work account, report it to your IT or security team immediately so they can invalidate active sessions and check for further access. Watch for unusual account activity, and if financial information was involved, contact the relevant institution.
