# What Is Phishing? Phishing Attacks, Fake Emails and User Security **URL:** https://securesys.com.tr/en/learning/end-user-security/what-is-phishing ![What Is Phishing? Phishing Attacks, Fake Emails and User Security](/images/bilgi-merkezi/covers/cover-sonkullanici-02.webp) Phishing is one of the best known attack types in cyber security. However, most users think of phishing only as: "a fake e-mail" they think of it as this. In reality modern phishing attacks are far more advanced. An attacker; e-mail, SMS, telephone, QR code, a fake login screen, an OAuth consent screen, a fake support call, a cloud sharing invitation can use many channels such as these. The aim is sometimes to steal a password. Sometimes it is to obtain an MFA approval. Sometimes it is to capture a session token. And sometimes it is to make the user carry out a financial transaction. For this reason phishing must not be handled only at the level of: **"Do not click suspicious links."** at this level. The modern phishing attack chain progresses more in this way: #### Initial Contact ↓ #### Social Engineering ↓ #### User Interaction ↓ #### Credential / Session Theft ↓ #### Account Takeover ↓ #### Persistence / Abuse For this reason phishing defense must not be limited to awareness training either. A strong phishing defense model: **Email Security + Identity Security + MFA + Browser Security + Endpoint Security + User Awareness + Monitoring** must consist of the combination of these. ### What Is Phishing? Phishing is, by deceiving the user: credentials, sensitive information, a financial transaction, malicious file execution or unauthorized access it is the social engineering attack aimed at obtaining these. ### What Is an Oltalama Attack? The most widespread Turkish equivalent of phishing: **oltalama saldırısı** is used as this. The aim is to make the user believe that they are communicating with a real institution, person or service. ### Why Is Phishing So Effective? Because instead of a technical weakness it most often targets: **human behaviour** it targets this. ### Which Psychological Elements Does Phishing Use? Urgency Authority Fear Curiosity Trust ### What Is Urgency-Based Phishing? It is the user being given the feeling that they need to take action immediately. ### Example Urgency Messages "Your password will be closed within 30 minutes." "Your payment must be completed today." "Your account will be suspended." ### What Is Authority-Based Phishing? It is the attacker behaving like the CEO, IT, a bank, an official institution or a manager. ### What Is Fear-Based Phishing? It tries to make the user decide quickly out of fear or anxiety. ### What Is Curiosity-Based Phishing? A file, message or link that arouses curiosity is used. ### What Is Trust Exploitation? A person, brand or business relationship the user knows is imitated. ### What Is Spear Phishing? It is the targeted phishing attack specially prepared for a particular person or organization. ### Why Is Spear Phishing More Dangerous? The message can contain real information about the victim. ### Which Information Can Spear Phishing Use? Job Title Company Colleague Name Project Name ### What Is Whaling? It is the type of spear phishing that targets senior executives such as the CEO, CFO or a board member. ### Why Is Whaling Critical? High-value users: sensitive information, payment approval, privileged access can have authorities such as these. ### What Is Smishing? Smishing: #### SMS Phishing is the phishing attack carried out over SMS or a messaging platform. ### Examples of Smishing A parcel delivery A bank notification A penalty notification A password reset link ### What Is Vishing? Vishing: #### Voice Phishing is the social engineering attack carried out over the telephone or voice communication. ### How Does Vishing Work? The attacker: IT support, a bank employee, a vendor can behave like these. ### What Is Caller ID Spoofing? It is the telephone number being shown on the screen as a different number. ### Can an MFA Code Be Asked For in Vishing? Yes. For this reason the user must be taught: #### not to share the MFA code they must be taught this. ### What Is Quishing? Quishing is the phishing attack carried out using a QR code. ### Why Is QR Phishing Effective? The destination URL inside the QR code may not be seen directly by the user. ### Where Can QR Phishing Be Used? E-mail Poster Invoice Document ### What Is QR Phishing Defense? QR destination analysis and user awareness are important. ### What Is Credential Phishing? It is the phishing attack aimed at stealing the user's username and password. ### What Is a Fake Login Page? It is the malicious web page that imitates the real login screen. ### What Can a Fake Login Page Imitate? Microsoft 365 Google VPN Portal Banking Login ### How Does the User Recognize a Fake Login Page? The domain, the certificate, an unexpected redirect, design inconsistency these must be checked. ### Why Is Checking the Domain Critical? The appearance of the page can be imitated exactly. The domain, on the other hand, provides a more reliable signal. ### What Is a Lookalike Domain? It is the fake domain that visually resembles the real domain. ### An Example Lookalike Approach Real: company.com Fake: cornpany.com ### What Is Typosquatting? It is domains resembling a spelling mistake being registered for a malicious purpose. ### What Is a Homograph Attack? It is a domain being imitated using similar-looking Unicode characters. ### What Is Punycode? It is the ASCII representation format of internationalized domain names. ### Why Should Attention Be Paid to the Homograph Risk? The characters can look the same to the user. ### What Is Subdomain Phishing? It is the attack that aims for the user to look only at the beginning part of the domain. ### An Example secure-login.company.example-malicious.com Here the real registered domain can be different. ### What Is URL Inspection? It is the analysis of the real destination address of the link. ### What Is Hover Link Checking? It is the destination URL being seen by holding the mouse over the link. ### Is a Short URL Risky? Not every short URL is malicious. However, it can hide the destination. ### What Is a URL Shortener? It is the service that converts a long URL into a short link. ### What Is a Redirect Chain? It is one URL performing successive redirects to other URLs. ### What Is Open Redirect? It is the weakness that allows a redirect to an external URL on a legitimate website. ### Can Open Redirect Be Used in Phishing? Yes. The legitimate domain can appear as the first link. ### What Is a Malicious Attachment? It is the file that carries malware or an exploit over an e-mail attachment. ### In Which Formats Can Harmful Attachments Be? Office Documents PDF Archive Executable ### Is a ZIP Attachment Risky? Not every ZIP file is malicious. However, it can be used to escape security controls. ### Why Is a Password-Protected Archive Used? The security scanner may not be able to analyze the file content. ### Can an ISO or Disk Image Attachment Be Risky? Yes. It can be used to carry malicious content. ### What Is Macro-Based Phishing? The execution of malicious code using an Office macro is targeted. ### What Is a Macro? It is the programming mechanism used for Office automation. ### Should Macro Use Be Controlled? Yes. ### What Is Protected View? It is the security feature that helps untrusted Office documents to be opened in a restricted mode. ### What Is an Embedded Object? It is a different file or object added inside a document. ### What Is a Malicious PDF? It is the abuse of the link, script or exploit mechanisms inside a PDF. ### Is Opening a PDF Always Safe? No. The reader software must be kept up to date. ### What Is HTML Attachment Phishing? It is a local fake login page or redirect being created using an HTML file. ### What Is HTML Smuggling? It is the delivery technique class based on a file payload being created using a script in the browser. ### What Is Email Phishing? It is the phishing message being sent over e-mail. ### What Is Email Spoofing? It is the sender identity being shown falsely. ### What Is Display Name Spoofing? It is the sender's visible name being shown as a trusted person. ### An Example Display Name: CEO Name Actual Sender: unknown@example-malicious.com ### Should the User Look Only at the Display Name? No. The sender address must be checked. ### What Is Reply-To Manipulation? It is the visible From address and the Reply-To address being different. ### Why Should Reply-To Be Checked? The reply can go to an attacker-controlled mailbox. ### What Is SPF? SPF: #### Sender Policy Framework determines which mail servers can send e-mail on behalf of the domain. ### What Is DKIM? DKIM: #### DomainKeys Identified Mail provides message integrity and domain authentication by adding a cryptographic signature to the e-mail. ### What Is DMARC? DMARC: #### Domain-based Message Authentication, Reporting and Conformance evaluates the SPF and DKIM results with policy. ### Does DMARC Completely Prevent Phishing? No. ### Why? The attacker: a lookalike domain, a compromised account, legitimate mail infrastructure can use these. ### What Is a Secure Email Gateway? It is the platform class that analyzes inbound and outbound e-mail traffic from a security point of view. ### What Can a Secure Email Gateway Check? Spam Malware Phishing Attachment URL ### What Is URL Rewrite? It is the link inside the e-mail being changed so that it will be analyzed through the security gateway. ### What Is Time-of-Click Protection? It is the link being analyzed again at the moment the user clicks it. ### Why Is This Important? The attacker can make the domain malicious after the e-mail has been sent. ### What Is a Sandbox? It is a suspicious file being run in an isolated environment and its behaviour being analyzed. ### What Is Attachment Sandboxing? It is the e-mail attachment being analyzed in a sandbox environment before it reaches the user. ### What Is CDR? CDR: #### Content Disarm and Reconstruction is the approach of the active content inside a document being removed and a safe copy being created. ### Can CDR Be Used Against Phishing? Yes. Particularly against malicious documents. ### What Is BEC? BEC: #### Business Email Compromise is the fraud attack carried out through the abuse of the corporate e-mail process or accounts. ### Does BEC Always Use Malware? No. In most cases malware is not needed. ### What Is CEO Fraud? It is the attacker asking for a payment or information by behaving like the CEO or a senior executive. ### What Is Invoice Fraud? It is a payment being made through a fake or altered invoice. ### What Is Payment Diversion Fraud? It is the payment being directed to an attacker-controlled bank account. ### What Is Vendor Email Compromise? It is the real vendor e-mail account being compromised and the existing correspondence being abused. ### Why Is Vendor Compromise Dangerous? The message really comes from a known contact. ### What Is Thread Hijacking? It is the attacker gaining trust by joining an existing e-mail conversation. ### What Is Mailbox Rule Abuse? It is an e-mail forwarding or hiding rule being created in a compromised mailbox. ### What Is an Inbox Rule? It is the message handling policy on the mail client/server. ### Why Does the Attacker Use an Inbox Rule? In order to hide security notifications or victim responses. ### What Is Suspicious Inbox Rule Detection? It is the detection of unusual forwarding/deletion rules. ### Is External Forwarding Risky? Yes. It can provide data leakage and persistence. ### Should Auto-Forwarding Be Controlled? Yes. ### What Is Account Takeover? ATO: #### Account Takeover is the attacker taking over the control of a legitimate user account. ### How Does Phishing Turn Into Account Takeover? Credential Theft ↓ Login ↓ Session ↓ Mailbox Access ### Does MFA Prevent Account Takeover? It can reduce it significantly. However, it does not prevent every attack. ### What Is MFA Fatigue? It is the attacker continuously sending MFA push notifications to the user. ### What Is MFA Bombing? It is another term used for MFA Fatigue. ### Why Might a User Approve MFA by Mistake? Because of notification fatigue or confusion. ### What Should Be Done If an Unexpected MFA Push Arrives? It must not be approved and it must be reported to the security team. ### What Is Number Matching? It is the number on the login screen being verified through the authenticator during MFA approval. ### Does Number Matching Reduce the Risk? It can help to reduce the push fatigue risk. ### What Is Phishing-Resistant MFA? It is the MFA method that makes it harder for the phishing site to reuse the authentication factor. ### What Is FIDO2? It is the phishing-resistant authentication standard based on public key cryptography. ### What Is WebAuthn? It is the web standard that allows browsers and applications to use public-key authentication. ### What Is a Security Key? It is the FIDO-based physical authentication device. ### What Is a Passkey? It is the modern authentication credential model that uses public-key cryptography instead of a password. ### What Is MFA Bypass? It is the attacker trying to cross the multi-factor authentication control. ### What Is Adversary-in-the-Middle Phishing? It is the phishing class in which the attacker tries to capture the authentication session information by placing an intermediate layer similar to a reverse proxy between the user and the legitimate login service. ### What Is AiTM? #### Adversary-in-the-Middle it is the abbreviation of this. ### Why Is AiTM Dangerous? The user can appear to be authenticating to the real service. ### What Is a Session Cookie? It is the browser cookie that represents the authenticated session state. ### What Is Session Token Theft? It is the capture of the session token information of an authenticated user. ### Can an Account Be Taken Over Without the Password Being Stolen? Yes. It can be possible with session or token theft. ### Does MFA Prevent Session Theft? Not always. MFA protects the moment of authentication. After the session, token abuse can be possible. ### What Is Session Hijacking? It is the user's active authenticated session being taken over by the attacker. ### What Is Token Replay? It is a captured token being tried again from a different system/session. ### What Is Token Protection? It is the security approach for the authentication token being bound to the expected device or context. ### What Is Conditional Access? It is the access decision being made according to contexts such as user, device, location and risk. ### Does Conditional Access Reduce the Phishing Risk? Yes. ### An Example Correct Password MFA Completed Unmanaged Device ↓ Access Denied ### What Is Device Compliance? It is the endpoint being in a state that conforms to the security policy. ### What Is Impossible Travel? It is the same user appearing to log in from different locations in a time too short to be physically possible. ### Is Impossible Travel Always an Attack? No. VPNs and cloud infrastructure can create false positives. ### What Is New Device Login? It is the user account authenticating over a device not seen before. ### Is a New Device Alert Useful? Yes. It can provide risk context. ### What Is an Unusual Login? It is authentication activity that deviates from normal user behaviour. ### What Is OAuth Phishing? It is the type of phishing in which the user is asked to give OAuth permission to a malicious application. ### What Is OAuth? It is the authorization framework used to provide an application with limited delegated access to user resources. ### What Is Consent Phishing? It is the user being made to give permission to a malicious application. ### Is the Password Stolen in Consent Phishing? Not always. The user can log in on the real identity provider. ### Why Is This Dangerous? The malicious application can receive a legitimate token. ### Examples of OAuth Permissions Read Mail Read Files Access Contacts ### Should User Consent Be Controlled? Yes. ### What Is Admin Consent? It is the application permission being approved by an administrator. ### What Is OAuth App Governance? It is third-party application permissions being managed centrally. ### What Is Cloud Sharing Phishing? It is user interaction being obtained through a fake or malicious cloud document sharing notification. ### Can There Be a Fake SharePoint/OneDrive Invitation? Yes. ### Can a Real Cloud Service Be Used for Phishing? Yes. The attacker can host malicious content on a legitimate cloud platform. ### Is a Trusted Domain Always Safe? No. A legitimate service can be abused. ### What Is CAPTCHA Phishing? It is the attacker giving a feeling of trustworthiness by showing a CAPTCHA before the fake login. ### Does a CAPTCHA Show That the Site Is Safe? No. ### What Is a Browser-in-the-Browser Attack? It is the technique of deceiving the user by creating the appearance of a fake authentication pop-up inside the browser. ### What Is a Fake SSO Popup? It is the fake login window that resembles the real Single Sign-On dialog. ### What Is SSO? Single Sign-On. It provides access to more than one application with a single identity. ### Does SSO Increase the Phishing Risk? The compromise impact can grow. For this reason MFA and conditional access are important. ### Does a Password Manager Help Against Phishing? Yes. A password manager may not autofill the password on the wrong domain. ### Can Password Autofill Be a Security Signal? Yes. A credential not being suggested on the expected domain can be a warning for the user. ### How Does Browser Security Reduce Phishing? Safe Browsing URL Reputation Download Protection Certificate Warning ### Does a Certificate Show That an HTTPS Site Is Safe? No. HTTPS only provides connection encryption. A malicious site can also use a valid TLS certificate. ### Is Trusting the Padlock Icon Enough? No. The domain must be verified. ### What Is Domain Reputation? It is the risk level of the domain in terms of its history and threat intelligence. ### What Is URL Reputation? It is the evaluation of whether a particular URL is associated with malicious activity. ### What Is a Newly Registered Domain? It is an internet domain created recently. ### Can a Newly Registered Domain Be a Phishing Indicator? Yes. But on its own it is not proof. ### What Is Domain Age Detection? It is the domain registration period being evaluated as risk context. ### How Is Threat Intelligence Used in Phishing? Detection is enriched with known malicious domain, IP, URL and campaign information. ### What Is an IOC? IOC: #### Indicator of Compromise is the indicator of a compromise. ### Examples of Phishing IOCs Malicious Domain URL Sender Address Attachment Hash ### What Is a Hash? It is the unique-like digital fingerprint calculated from the file content. ### How Is an Attachment Hash Used in Security? It can be compared with a known malware database. ### What Is a Threat Campaign? It is more than one attack associated with the same attacker or infrastructure being evaluated as a common campaign. ### What Is a Phishing Campaign? It is the same or similar phishing content being sent to particular targets. ### What Is Mass Phishing? It is a generic phishing message being sent to a large number of users. ### What Is Targeted Phishing? It is the attack that targets a particular user or department. ### Why Is the Finance Department a Phishing Target? It can have payment and banking process authority. ### Why Can HR Be a Target? It can have access to personal data and employee records. ### Why Can an IT Admin Be a Target? They can have privileged credentials and infrastructure access. ### Why Can an Executive Be a Target? Sensitive information and approval authority are high. ### What Is Role-Based Phishing Defense? It is special security training and controls being applied according to the user's role. ### What Is a High-Risk User? It is the user who carries a higher phishing impact according to their role or access level. ### What Should Be Done for High-Risk Users? Stronger MFA Targeted Training Enhanced Monitoring ### What Is Phishing Detection? It is the phishing message or behaviour being detected with technical or human analysis. ### How Does Email Security Detect Phishing? Sender Reputation URL Analysis Attachment Analysis Content Analysis ### Can NLP Be Used for Phishing Detection? Yes. Language pattern analysis can help. ### Is AI Used for Phishing Detection? Yes. It can be used for message context and anomaly detection. ### Can AI Catch All Phishing? No. False positives and false negatives can occur. ### What Is a False Positive? It is a legitimate e-mail being marked as malicious. ### What Is a False Negative? It is a malicious phishing e-mail escaping detection. ### Why Is User Reporting Important? Phishing that the security tools miss can be noticed by the user. ### What Is a Phishing Report Button? It is the suspicious message reporting feature inside the mail client. ### Should the User Report Go to the SOC? Yes. ### What Should Happen When the User Reports Phishing? Automated triage or SOC investigation can begin. ### What Is Phishing Triage? It is the evaluation of whether the reported message is real phishing. ### What Does Triage Examine? Sender Header URL Attachment Authentication Results ### What Is an Email Header? It is the metadata that contains the message routing and authentication information. ### What Is a Received Header? They are the header fields that show the mail servers the e-mail passed through. ### What Is Authentication-Results? It is the header information in which the e-mail authentication results such as SPF, DKIM and DMARC are found. ### What Is Return-Path? It is related to the envelope sender information to which bounce messages are sent. ### Can the Sender and the Return-Path Be Different? Yes. It can also happen in legitimate situations. For this reason context is needed. ### What Does a SOC Phishing Investigation Examine? Message Recipients Clicks Login Activity Endpoint Events ### What Is Click Tracking? It is the determination of which user reached the phishing URL. ### If the User Clicked the Link What Should the First Question Be? Did they only click, did they enter credentials, did they download a file, was a session created these must be analyzed. ### How Is Credential Exposure Investigated? Identity logs and authentication events are examined. ### What Should Be Done If the User Entered Credentials? The incident response procedure must be applied. ### Typical Credential Phishing Response Password Reset ↓ Session Revoke ↓ MFA Review ↓ Endpoint Check ↓ Account Audit ### What Is Session Revoke? It is active authentication sessions being made invalid. ### Is Only a Password Reset Enough? Not always. Existing sessions may be continuing. ### What Is a Refresh Token? It is the longer-lived authentication token used to obtain a new access token. ### What Is Token Revocation? It is existing authentication tokens being cancelled. ### Why Should a Mailbox Audit Be Performed? The attacker may have reached the mailbox. ### Should the Inbox Rules Be Checked? Yes. ### Should External Forwarding Be Checked? Yes. ### Should Sent Items Be Checked? Yes. The compromised account may have sent phishing to other users. ### What Is Internal Phishing? It is phishing being sent to users inside the organization over a compromised internal account. ### Why Does Internal E-mail Look More Trustworthy? The sender can be a legitimate company account. ### What Is Lateral Phishing? It is a compromised internal account being used to target other internal users. ### Why Is Lateral Phishing Dangerous? The trust level is high. ### How Should the Internal Phishing Response Be? Compromised Account Disable Session Revoke Message Search/Removal User Notification ### What Is Search and Purge? It is the malicious e-mail being searched for centrally in the organization's mailboxes and deleted. ### What Is Phishing Incident Response? It is the user, identity, endpoint and e-mail environment being examined in a controlled way after a phishing event. ### The Phishing IR Lifecycle Detect ↓ Validate ↓ Contain ↓ Investigate ↓ Recover ↓ Learn ### What Is Containment? It is to limit the spread of the attack and continued access. ### Examples of Phishing Containment Block URL Block Domain Disable Account Revoke Session ### Can Endpoint Isolation Be Needed? If malware has run, yes. ### How Is EDR Used in a Phishing Incident? The downloaded file, process execution, network connections these can be analyzed. ### How Does NDR Help in a Phishing Incident? It can detect C2 or unusual network behaviour after the compromise. ### How Is the SIEM Used in a Phishing Incident? Email, identity, endpoint and network events can be correlated. ### Is SOAR Used in Phishing Response? Yes. ### An Example Automated Phishing Playbook User Report ↓ URL Reputation Check ↓ Attachment Hash Check ↓ Mailbox Search ↓ Create SOC Case ### Can High-Confidence Phishing Be Deleted Automatically? Depending on the policy and the risk evaluation, yes. ### Why Is Human-in-the-Loop Important? Business-critical legitimate mail can be deleted by mistake. ### What Is Phishing Simulation? It is a controlled phishing campaign being applied in order to measure user awareness and response behaviour. ### Is Phishing Simulation a Real Attack? No. It is an authorized training activity. ### What Is the Aim of the Simulation? Not to punish the user but: **to measure and improve risky behaviour.** ### What Are the Phishing Simulation KPIs? Click Rate Credential Submission Rate Reporting Rate ### What Is Click Rate? It is the proportion of users who click the simulation link. ### What Is Credential Submission Rate? It is the proportion of users who enter credentials into the fake login form. ### What Is Reporting Rate? It is the proportion of users who report the simulation message to the security team. ### Which One Is More Important? A single metric is not enough. The reporting rate is particularly valuable. ### What Is Mean Time to Report? It is the average time between the phishing message arriving and the user reporting it. ### Why Is Mean Time to Report Critical? An early report can help to protect the other users. ### What Is Repeat Failure Rate? It is the proportion of users who repeat risky behaviour in more than one simulation. ### How Should Repeat Failure Be Managed? With targeted training and coaching. ### Should Phishing Simulation Be Very Difficult? It must be gradual according to the risk level and user maturity. ### Can a Simulation Use Real Brand Imitations? It must be designed within policy, ethical and legal limits. ### Is It Right to Shame the User? No. The security culture can be damaged. ### What Is a Positive Security Culture? It is the environment in which the user can report a mistake or a suspicious event without fear. ### Should a User Who Clicks Phishing Be Punished? The general approach must be focused on risk reduction and training. ### Should the User Be Encouraged When They Report? Yes. ### What Is a Security Champion? It is the person or role who supports security awareness inside a department. ### What Should Phishing Awareness Training Contain? Sender Check Domain Check Link Check MFA Awareness Reporting ### **Is Saying "Do Not Click Links" Enough?** No. Because business life requires the use of links. ### What Should the User Be Taught? **To evaluate the signals between a risky link and a normal link.** ### What Is the Golden Rule of Phishing Awareness? Unexpected + Urgent + Credential/Payment Request this combination can be a high risk signal. ### What Should the Extra Control Be in Payment Phishing? Out-of-band verification. ### What Is Out-of-Band Verification? It is the request being verified over another independent communication channel. ### An Example E-mail: "The bank account has changed." ↓ Call the Vendor From a Known Phone Number ↓ Confirm ### Should the Telephone Number Inside the E-mail Be Used? If the message is suspicious, no. Known contact information must be used. ### What Is BEC Payment Control? It is payment instructions not depending on the decision of a single person. ### What Is Dual Approval? It is the approval of two authorized people being required for a critical payment. ### What Is the Four-Eyes Principle? It is the principle of a critical action being verified by a second person. ### Are Financial Controls Part of Cyber Security? In terms of BEC, yes. ### Why Should Security Awareness + Business Process Be Together? Because BEC can bypass technical controls. ### How Is a Phishing-Resistant Organization Created? Technology and people must be protected together. ### Layered Phishing Defense DNS / Domain Security ↓ Email Authentication ↓ Secure Email Gateway ↓ URL / Attachment Analysis ↓ Browser Security ↓ MFA / Identity Protection ↓ EDR ↓ User Awareness ↓ SOC Monitoring ### What Is Phishing Defense in Depth? It is another layer stopping or detecting the attack if one security layer misses the phishing. ### An Example Defense Chain Phishing Mail Passed Gateway ↓ User Clicked ↓ Browser Blocked URL ### Another Example User Opened Site ↓ Entered Password ↓ Phishing-Resistant MFA Prevented Login ### Another Example Session Compromised ↓ Conditional Access Detected Risk ↓ Session Revoked ### Should the User Be the Last Failure Point? No. ### What Is Secure-by-Design Phishing Defense? It is the architecture that makes it difficult for user error to turn into a compromise. ### What Is a Phishing Risk Assessment? It is the evaluation of the organization's current risk and control level against phishing attacks. ### What Does the Assessment Examine? Email Security Identity Security MFA Awareness Incident Response ### What Does an Email Security Assessment Examine? SPF DKIM DMARC Gateway URL Protection ### What Does an Identity Assessment Examine? MFA Legacy Authentication Conditional Access Session Control ### What Is Legacy Authentication? They are the old authentication protocols that do not support modern MFA/conditional access controls. ### Why Is Legacy Authentication Risky? It can create an MFA bypass path. ### What Is Basic Authentication? It is the term widely used for the old username/password based authentication model. ### What Is Modern Authentication? It is the authentication approach that supports token-based modern identity protocols and MFA. ### Phishing Risk KPIs Phishing Reporting Rate Click Rate Credential Submission Rate Mean Time to Report ### Phishing KRIs No MFA Users Legacy Authentication DMARC Weak Policy High-Risk Users ### What Should a Phishing Dashboard Show? Reported Messages Confirmed Phishing Affected Users Compromised Accounts ### What Should a Security Awareness Dashboard Show? Simulation Trends Reporting Trends Repeat Failures Training Status ### Phishing Maturity Model #### Level 1 - Basic Awareness Phishing training is given to users. The technical controls are limited. #### Level 2 - Email Protection SPF, DKIM, DMARC and a secure email gateway are used. #### Level 3 - Identity Protection MFA, conditional access and risky login detection are applied. #### Level 4 - Integrated Detection and Response Email, identity, EDR, SIEM and the SOC work together. #### Level 5 - Phishing-Resistant Architecture Phishing-resistant MFA, adaptive access, automated containment and continuous awareness are applied together. ### Phishing Checklist - Has SPF been configured? - Is DKIM active? - Is a DMARC policy being applied? - Is there a secure email gateway? - Is URL protection active? - Is there attachment sandboxing? - Is external sender tagging being applied? - Is MFA mandatory? - Has phishing-resistant MFA been evaluated? - Is legacy authentication disabled? - Is conditional access being applied? - Is there risky login detection? - Is there session revocation capability? - Is OAuth app consent under control? - Is inbox rule monitoring being performed? - Is external forwarding being controlled? - Is there a phishing report button? - Do the user reports go to the SOC? - Is there search-and-purge capability? - Is phishing simulation being carried out? - Is the reporting rate being measured? - Are high-risk users being identified? - Is there a payment verification process for finance? - Are vendor bank account changes verified out-of-band? - Is a phishing incident response playbook available? ### The Most Frequently Made Mistakes in Phishing The mistakes frequently seen in organizations: - Seeing phishing only as a spam problem - Using SPF/DKIM and neglecting DMARC - Leaving DMARC only at the monitoring level - Only telling the user "do not click links" - Not using MFA - Relying only on SMS MFA - Leaving legacy authentication open - Not taking the session/token theft risk into account - Ignoring OAuth consent phishing - Not controlling external forwarding - Not performing inbox rule monitoring - Making the user reporting process difficult - Evaluating the phishing simulation results only with the click rate - Not using independent verification in the finance processes - Only changing the password after a compromise - Not revoking the active sessions - Not performing a mailbox audit - Ignoring the internal lateral phishing risk - Not applying extra controls for high-risk users - Limiting the awareness program to one training a year ### Frequently Asked Questions #### What is phishing? Phishing is the social engineering attack that aims to obtain credentials, sensitive data, a financial transaction or a malicious action by deceiving the user. #### What is an oltalama attack? Oltalama saldırısı is the Turkish equivalent of phishing and it aims to deceive the user through a fake message, site or identity. #### What is spear phishing? It is the targeted phishing attack specially prepared for a particular person or organization. #### What is smishing? It is the phishing attack carried out over SMS. #### What is vishing? It is the phishing/social engineering attack carried out over the telephone or voice communication. #### What is quishing? It is the phishing attack that directs the user to a malicious web site using a QR code. #### What is BEC? Business Email Compromise is the fraud attack in which e-mail accounts and business processes are abused. #### How is a phishing mail recognized? Signals such as an unexpected request, urgency, an unusual sender, a suspicious domain and a credential or payment request must be checked. #### Do SPF, DKIM and DMARC prevent phishing? They can significantly reduce the domain spoofing risk but they do not completely prevent phishing carried out over a lookalike domain or a compromised account. #### Does MFA prevent phishing? MFA significantly reduces the account takeover risk but on its own it may not be sufficient against session theft, MFA fatigue or some adversary-in-the-middle attacks. #### What is phishing-resistant MFA? It is the MFA approach that reduces the phishing risk with public-key based authentication methods such as FIDO2/WebAuthn. #### What is session hijacking? It is the session information of an authenticated user being captured by the attacker. #### Can an account be taken over with phishing without giving a password? Yes. With methods such as session token theft or a malicious OAuth consent, unauthorized access can occur without the password being stolen directly. #### What is OAuth phishing? It is the attack in which the user is made to give a malicious application access permission for e-mail, files or other cloud resources. #### What is phishing simulation? It is the controlled security awareness exercise carried out to measure users' phishing awareness and reporting behaviour. #### What should be done if a user clicks phishing? How much interaction took place must be determined; credential exposure, session compromise and endpoint activity must be checked and the organization's incident response procedure must be applied. ### Conclusion: Modern Phishing Is No Longer Only Trying to Steal Passwords For many years phishing was explained with this simple scenario: **A fake e-mail arrives.** ↓ **The user clicks the link.** ↓ **They enter their password.** ↓ **The attacker steals the password.** This scenario is still valid. However, modern phishing is far more complex than this. Today the attacker; can steal a password, can try to obtain an MFA approval, can ask for OAuth permission, can capture a session token, can perform internal phishing over a compromised account, can create a mailbox rule, or can direct the finance team into a fake payment transaction. Therefore phishing defense cannot remain only at the level of: **"Do not give your password to anyone."** at this level. The modern phishing defense chain must be thought of in this way: #### Prevent ↓ #### Detect ↓ #### Verify ↓ #### Contain ↓ #### Respond On the prevention side: SPF, DKIM, DMARC, Secure Email Gateway, URL Protection these are used. On the identity side: MFA, phishing-resistant authentication, conditional access, session controls these are applied. On the endpoint side: EDR, browser security, application control these come into play. On the human side: security awareness, phishing simulation, user reporting these are needed. On the operations side: SIEM, SOC, SOAR, incident response these are used. One of the most critical points is this: **When a phishing attack is successful do not assume that changing the password alone is enough.** Because the attacker: an active session, a refresh token, a mailbox rule, an OAuth permission may have used other persistence mechanisms such as these. For this reason a real phishing incident response: **Identity + Session + Mailbox + Endpoint + Network** must be carried out by evaluating these together. And from the user's perspective the most important principle of modern phishing defense: **Look not at how professional the message looks but at what it asks you to do.** If an unexpected message; credentials, an MFA approval, a payment, opening a file, an application permission asks for these, the user must stop for a moment and verify the request independently. If the modern phishing risk is to be summarized in a single sentence: **The attacker's target is not your password but your identity and your session.** For this reason the strong phishing defense formula: **Email Security + Identity Security + Phishing-Resistant MFA + User Awareness + Detection + Incident Response** it must be this.