Phishing red flags are warning signs and indicators that help users identify fraudulent emails, messages, or websites designed to steal sensitive information, credentials, or money.

A gift card scam (in the Business Email Compromise context) is a social engineering attack in which an attacker impersonates a CEO, executive, or other authority figure via spoofed or compromised email and manipulates an employee into purchasing retail gift cards and sending back the card numbers...

A romance scam, also called a pig butchering scam when focused on investment exploitation, is a multi-stage online relationship and investment fraud where perpetrators cultivate fake romantic or social relationships with victims before persuading them to invest money in fraudulent schemes, typica...

A technical support scam is a fraud scheme where perpetrators impersonate employees of trusted technology companies—Microsoft, Apple, Google, Adobe, and others—and claim the victim's device has a security problem, malware infection, or software issue requiring immediate attention.

A voice cloning attack is a social engineering assault that uses artificial intelligence to generate a convincing synthetic replica of a target's voice, typically a trusted individual such as a company executive, family member, or colleague.

A watering hole attack is a form of cyberattack that targets groups of users by infecting websites that they commonly visit.

Advance-fee fraud, also known as advance-fee scams or 419 fraud, occurs when the victim pays money in anticipation of receiving something of greater value—such as a loan, contract, investment, gift, inheritance, or lottery winnings—and then receives little or nothing in return.

AI-generated phishing leverages large language models, generative AI, and machine learning algorithms to create, personalize, and scale malicious emails, messages, and multimedia content at unprecedented speed and sophistication.

An evil twin attack is a rogue wireless access point that impersonates a legitimate Wi-Fi network by duplicating its network name (SSID) and often its password, thereby deceiving users into connecting to the attacker's network instead of the authentic one.

An insider threat is the threat that an insider will use their authorized access, intentionally or unintentionally, to do harm to an organization's mission, resources, personnel, facilities, information, equipment, networks, or systems, according to CISA's 2024 definition.

Angler phishing is a social engineering attack where cybercriminals create fake customer service profiles on social media to target customers who publicly complain about or request assistance from a company.

Bulk phishing is a mass-scale social engineering attack in which cybercriminals send deceptive emails to hundreds, thousands, or millions of recipients with the goal of compromising as many victims as possible.

Business Email Compromise (BEC) is a targeted cyberattack in which adversaries assume the digital identity of a trusted persona—such as an executive, vendor, supplier, or legal representative—to trick employees into making unauthorized wire transfers, sharing sensitive data, or executing other fr...

Calendar phishing, also known as ICS phishing, is an attack method where cybercriminals send unsolicited calendar invitations via email attachments in iCalendar (ICS) format that exploit calendar application handling to deliver phishing payloads.

Callback phishing, also known as telephone-oriented attack delivery (TOAD), is a hybrid social engineering attack that combines email and voice (telephone) channels to compromise organizations.

CEO fraud is a targeted variant of Business Email Compromise in which adversaries impersonate a company's CEO or other C-suite executive to manipulate lower-level employees—typically in finance, HR, or accounts payable—into making unauthorized wire transfers, sharing sensitive data, or executing ...

Clone phishing is a phishing technique where attackers duplicate a legitimate email the target has previously received or would expect to receive, replacing links or attachments with malicious versions while preserving the original message structure, branding, logos, and wording.

Consent phishing, also known as an illicit consent grant attack, is a phishing technique that exploits OAuth 2.0 authorization flows. Instead of stealing credentials directly, the attacker tricks the victim into granting permissions to a malicious third-party application.

Cryptocurrency phishing is an attack aimed at tricking users into revealing recovery phrases, private keys, or login credentials for their cryptocurrency wallets and accounts.

Deepfake social engineering leverages generative AI to create synthetic audio, video, and multimedia content—typically deepfaked videos or voice-cloned audio—to impersonate legitimate authority figures, executives, or trusted individuals.

Device code phishing is a phishing technique that abuses the legitimate OAuth 2.0 device authorization grant flow to steal authentication tokens and compromise accounts.

Fake job phishing is a social engineering attack in which fraudsters impersonate legitimate employers or recruiters, offering fake employment opportunities to lure victims into divulging personal information, credentials, or money.

HTML smuggling is a sophisticated evasion technique that allows attackers to deliver malicious payloads by encoding them within specially crafted HTML files or web pages.

Image-based phishing, also called visual phishing, is a social engineering attack where cybercriminals embed phishing messages, fake login pages, or malicious content within image files rather than plain text.

Invoice fraud is a type of Business Email Compromise (BEC) in which attackers impersonate legitimate vendors or suppliers and send fraudulent invoices to a target organization's accounts payable department, or intercept and modify legitimate invoices to redirect funds to attacker-controlled accou...

An island hopping attack is a hacking campaign in which threat actors target an organization's more vulnerable third-party partners, vendors, or service providers to undermine the target company's cybersecurity defenses and gain access to their network.

Lateral phishing is a cyberattack in which an adversary uses a recently compromised email account within an organization to send phishing emails to other employees, contacts, or business partners.

Multi-channel phishing is a coordinated social engineering attack that distributes phishing payloads across multiple communication channels (email, SMS, Teams, Slack, voice calls, social media) within a single campaign or integrated attack sequence.

Payroll diversion fraud is a type of business email compromise (BEC) in which attackers impersonate an employee and contact an organization's payroll or HR department to request a change to the employee's direct deposit bank account information, redirecting the employee's paycheck to an attacker-...

PDF phishing is a form of social engineering attack in which cybercriminals send malicious PDF attachments via email to trick recipients into divulging sensitive information, installing malware, or compromising security.

Pharming is a cyberattack that redirects a website's traffic to a fraudulent replica by installing malicious code on a victim's computer or compromising DNS infrastructure.

Phishing is a social engineering attack in which threat actors masquerade as legitimate entities and send deceptive messages—typically via email, SMS, or messaging apps—to trick users into revealing sensitive data, downloading malicious software, or transferring funds.

Polymorphic phishing is an advanced form of email-based social engineering attack where the attacker continuously modifies the structural and content characteristics of phishing messages to evade detection by security systems and human judgment.

Precision-validated phishing is an advanced credential theft attack that employs real-time email validation mechanisms to confirm an email address is active and legitimate before displaying the phishing payload.

Quishing—a portmanteau of "QR code" and "phishing"—is a cyberattack in which adversaries create malicious QR codes to redirect victims to fraudulent websites designed to steal credentials, personal information, or financial data, or to deploy malware.

Robocall phishing, also known as vishing or voice phishing, is a social engineering attack delivered through automated phone calls or live voice conversations where fraudsters impersonate legitimate organizations to deceive victims into revealing sensitive personal information.

Search engine phishing (also called SEO poisoning or SEO trojan attacks) is a type of phishing scam where cybercriminals use search engine optimization (SEO) tactics and malicious websites to manipulate search engine algorithms, ranking fraudulent sites prominently in results to increase the like...

Sextortion is a form of online sexual exploitation and extortion where perpetrators use non-physical coercion to extract sexual images, videos, money, or other favors from victims by threatening to release intimate content.

Smishing, a portmanteau of "SMS" and "phishing," is a form of social engineering attack that uses text messages to trick recipients into divulging sensitive information, clicking malicious links, downloading harmful software, or transferring funds.

Social media phishing is a coordinated attack executed through social platforms where fraudsters use fake accounts, deceptive messages, and malicious links to steal private information including phone numbers, credit card numbers, bank account details, and other sensitive data.

Spear phishing is a targeted phishing attack directed at specific individuals or small groups using personalized information about the targets to increase credibility and click-through rates.

Supply chain phishing is a targeted attack that exploits trusted relationships between organizations and their vendors, suppliers, or service providers. Attackers use the trust between companies and vendors to send malicious emails containing fake invoices, credential phishing attempts, or malware.

SVG (Scalable Vector Graphics) phishing is an emerging social engineering attack that exploits SVG files—XML-based vector graphics formats—to deliver credential-harvesting pages, malware, or redirect users to fraudulent sites.

Teams/Slack phishing is a social engineering attack that exploits Microsoft Teams and Slack messaging platforms to deliver phishing payloads, steal credentials, or initiate broader multi-stage attacks.

Thread hijacking is a cyberattack technique in which an adversary inserts malicious messages into existing, legitimate email conversations to deliver malware, steal credentials, or redirect payments while exploiting the established trust of the ongoing thread.

TOAD stands for Telephone-Oriented Attack Delivery, a multi-stage social engineering attack that combines email phishing with voice (telephone) interaction. The attacker sends a phishing email containing no malicious links or attachments but urging the recipient to call a phone number.

Vendor Email Compromise (VEC), also called financial supply chain compromise, is a sophisticated Business Email Compromise variant in which an attacker compromises or impersonates a third-party vendor's email account to send fraudulent invoices, payment redirects, or other financially motivated m...

Vishing, short for "voice phishing," is a social engineering attack conducted via phone calls or voice messages to trick individuals into divulging sensitive information, authorizing transactions, or granting access to systems.

Voicemail phishing, also known as vishing (voice phishing), is a social engineering attack where cybercriminals use phone calls and voicemails to impersonate trustworthy organizations and manipulate victims into revealing sensitive information.

W-2 phishing is a targeted form of business email compromise in which attackers impersonate company executives or authority figures via spoofed or compromised email, sending urgent requests to payroll, HR, or accounting staff to hand over employee W-2 tax forms containing Social Security numbers,...

Whaling is a highly targeted phishing attack that impersonates or targets high-ranking executives—typically C-suite members, board directors, or senior leaders—to authorize wire transfers, steal sensitive data, or gain unauthorized access to strategic information.

WhatsApp phishing is a cyber scam where attackers deceive WhatsApp users into revealing sensitive information such as passwords, credit card numbers, or bank account details through deceptive messages, malicious links, and social engineering tactics.

A cybercriminal syndicate (also called organized cybercrime group or cybercrime organization) is a structured collective of threat actors organized with hierarchical roles, specialized skills, and division of labor designed to systematically execute criminal activities for financial gain.

A hacktivist is a politically motivated threat actor who uses hacking techniques and digital infrastructure exploitation to promote ideological, political, or social agendas.

A money mule is an individual (knowingly or unknowingly) recruited by criminals to receive illicit funds from fraud victims and transfer them to criminal operators or intermediaries.

A nation-state actor (also called state-sponsored actor or state-backed cyber actor) is a government or sovereign state entity that employs sophisticated cyber operational units to achieve national security objectives.

A script kiddie is an unskilled or inexperienced individual who uses pre-written scripts, tools, or programs developed by others to carry out cyberattacks. Script kiddies lack deep technical understanding of the underlying technology, security exploits, or programming languages.

A threat actor is any individual, group, or organization that intentionally carries out malicious activities against computer systems, networks, data, or other valuable digital assets.

Access-as-a-Service (AaaS) in cybercrime refers to the sale of unauthorized network access by Initial Access Brokers (IABs) to other threat actors.

An Advanced Persistent Threat (APT) is a stealthy, long-term cyberattack campaign conducted by a highly skilled threat actor—typically a nation-state or nation-state-sponsored group—that gains unauthorized access to a computer network and remains undetected for an extended period.

An Initial Access Broker (IAB) is a specialized cyber threat actor who focuses exclusively on gaining unauthorized access to computer networks and systems, then selling or leasing that access to other cybercriminals (typically ransomware operators, data thieves, or other attack groups).

Cybercrime-as-a-Service (CaaS) is an umbrella business model where specialized cybercriminal vendors sell packaged tools, services, and infrastructure to other threat actors, enabling cyberattacks with minimal technical expertise.

Malware-as-a-Service (MaaS) is a cybercrime business model offering pre-developed malware, exploit kits, and related infrastructure for purchase or subscription.

Ransomware-as-a-Service (RaaS) is a cybercrime business model where professional developers (ransomware operators) create, maintain, and distribute ready-made ransomware tools to affiliates (other cybercriminals) who execute attacks independently.