Phishing is a form of social engineering and a scam in which attackers deceive people into revealing sensitive information or installing malware. Phishing can be used for credential theft, session hijacking, malware delivery, or command execution. Some attacks transparently relay authentication to a legitimate site, allowing the attacker to capture credentials and authenticated sessions. Phishing is a common initial-access method, and Large language models can automate personalized phishing at low cost.

Common forms include general email phishing, targeted spear phishing and whaling, voice phishing (vishing), and SMS phishing (smishing). Other forms use QR codes or relay authentication through an adversary-in-the-middle.

Measures to prevent or reduce the impact of phishing attacks include legislation, user education, public awareness, and technical security measures.