Phishing (피싱)
Overview
Phishing is a social engineering cyber attack that impersonates trusted institutions or individuals to steal users' personal information, financial information, and login credentials via email, text messages, phone calls, fake websites, etc. It is a portmanteau of 'fishing' and 'phreaking' (phone communication hacking), meaning throwing bait to induce victims to hand over information themselves. Because it targets not technical vulnerabilities but human psychological weaknesses (trust, fear, urgency, curiosity), it is difficult to completely block with firewalls or antivirus alone, and many organizational security incidents begin with phishing.
Key Details
Etymology and History
The term 'phishing' is known to have first appeared around 1996 by a hacker group that stole user accounts from the American online service America Online (AOL). Initially, it was a simple method of extracting account information through emails impersonating AOL, but as online banking in the financial sector spread in the 2000s, phishing impersonating banks surged. Afterwards, targets expanded from individuals to corporations and government agencies, and methods evolved from mass random sending to targeted precision attacks.
How It Works
A typical phishing attack proceeds in the following stages. First, the attacker selects a target the victim trusts (bank, delivery company, government agency, business partner executive, etc.). Second, they forge an email address, sender number, and web page almost identical to the real one. Third, with messages that stimulate urgency, such as 'Your account has been suspended', 'Payment failed', 'Delivery address error', they induce immediate clicking, input, or money transfer. Fourth, the ID, password, card number, and authentication number entered by the victim are sent to the attacker's server. Finally, using the stolen information, they carry out account takeover, unauthorized payments, and secondary attacks (such as ransomware distribution).
Major Types
- Email phishing: The most traditional form, divided into mass sending or spear phishing targeting members of a specific organization.
- Whaling: An attack targeting high-level executives such as CEOs and executives to extract large-sum transfers or confidential documents.
- Smishing: A method of attaching malicious links to text messages (SMS), and one of the most frequent types occurring in Korea.
- Vishing: Also called voice phishing; impersonates institution or bank employees over the phone to demand money transfers or authentication numbers.
- Pharming: A method of manipulating DNS or host files so that even when a normal address is entered, the user is connected to a fake site.
- Clone phishing: Copies a legitimate email that was actually received, changes only the attachment or link to malicious, and resends it.
- Qshing: A form combining QR codes and phishing, impersonating payments, parking, electronic entry logs, etc., to induce installation of malicious apps.
- Man-in-the-middle attack (MITM): Intercepts the session between a fake login page and the real service, bypassing even two-factor authentication.
Scale and Impact of Damage
Phishing causes monetary loss, account takeover, and secondary identity theft for individuals, and brings trade secret leaks, ransomware infection, supply chain paralysis, enormous recovery costs, and reputational loss to companies. In particular, BEC (Business Email Compromise) is considered one of the threats the international security industry is most wary of, as a single incident can cause hundreds of millions of won in transfer damage.
Detection and Response
At the organizational level, spam and malicious link filtering at email gateways, sender domain authentication such as DMARC/SPF/DKIM, introduction of multi-factor authentication (MFA), sandbox inspection when links are clicked, and regular mock training for employees are effective. At the individual level, the key is to check the spelling of sender addresses and domains, reconfirm via official representative numbers especially for messages demanding urgency, not open links or attachments of unclear origin, and use different passwords for each account and app-based two-factor authentication. Upon recognizing damage, immediately changing passwords, suspending cards, reporting to financial companies, and reporting to the police (112) and the Korea Internet & Security Agency (118) can reduce the spread of damage.
Latest Trends
The biggest change in phishing in 2024–2025 is its combination with generative AI. Using large language models (LLMs) such as ChatGPT, natural multilingual phishing emails without grammatical errors are mass-produced, and 'deep voice vishing' that clones an executive's voice from just a few seconds of audio and deepfake video call scams are leading to actual financial incidents. In addition, with the shift of phishing kits to Cybercrime-as-a-Service (CaaS), criminals without specialized knowledge can easily run campaigns. On the defense side, phishing-resistant authentication (FIDO2·passkeys), zero trust architecture, and AI-based anomalous behavior detection are spreading, and regulators in various countries are strengthening obligations for financial companies and platforms to protect fraud victims and promptly block accounts. As mobile-centered qshing and malicious app distribution surge, security settings on smartphones themselves and restrictions on installation outside official app stores are also emerging as important lines of defense.
Related Topics
- [[Smishing]]
- [[Voice phishing]]
- [[Ransomware]]
- [[Social engineering attack]]
- [[Multi-factor authentication]]
- [[Personal Information Protection Act]]
- [[Zero trust]]
- [[Deepfake]]