OCTOBER AWARENESS MONTH        OCTOBER 2025

Phishing 101

Phishing is one of the most common cybersecurity threats today, and almost 85% of organizations have faced at least one successful phishing attack. Phishing emails look innocent and disguise themselves as legitimate messages. On average, it only takes 60 seconds to fall victim. That’s why it’s critical to Secure every Click – or risk getting reeled in.

Common types of phishing

Phishing comes in many forms, each designed to deceive you differently. While traditional phishing attacks cast a wide net, cybercriminals have developed more targeted techniques to increase success rates. Below are some of the most common phishing attacks you should know.

Whaling — A highly targeted phishing attack aimed at senior executives or high-profile individuals within an organization. Attackers impersonate trusted sources, often using urgent requests or legal pretexts to manipulate victims into revealing sensitive information or transferring funds. Even the biggest fish can get hooked – unless they Secure every Click.

Vishing — Short for "voice phishing," this type of attack occurs over the phone. Scammers pose as legitimate entities — such as banks, tech support or government agencies — to persuade their targets to reveal confidential information. Don’t let smooth talkers bait you – verify before you vocalize.

SMiShing — A phishing attack that uses SMS (text messages) to trick victims into clicking malicious links, sharing personal information, or downloading malware. Attackers often disguise themselves as banks, delivery services or government agencies

Spearphishing — A phishing attack that targets a specific individual, organization or business. Unlike generic phishing, spearphishing emails are customized using personal details — often obtained from social engineering or previous breaches — to appear more convincing.

Clone phishing — A phishing attack where a legitimate email is copied and altered to contain malicious links or attachments. The attacker spoofs the sender’s address and resends the email to trick recipients into interacting with the fraudulent content.

Understanding and familiarizing yourself with the many ways one can be phished helps you recognize the red flags and avoid falling victim. Attackers rely on deception. Your best defense is staying alert, researching and always thinking before you click!

Business Email Compromise

73% of organizations reported a Business Email Compromise (BEC) attack, yet only 29% train users to recognize them.

BEC is a scam where attackers impersonates a trusted contacts, like trusted executives or vendors, to trick someone into sending money or providing sensitive information.

Unlike traditional phishing, BEC attacks do not rely on links or attachments for a user to click. Instead, the attacker uses social engineering techniques such as email spoofing and pretexting – creafting urgent backstories (e.g. I’m the CFO, send a wire now”) to pressure employees into skipping verifications. It’s all about panic over proof. 

BEC is one of the most financially damaging cyberthreats, with billions lost globally each year. Knowing how attackers use pretexting to build false trust is key to spotting and stopping these scams. No click required to cause damage – so always Stay vigilant.

Phishing simulations’ most popular “subjects”

Phishing emails have one main goal: to lure you into clicking a link and providing your personal and user information. Phishing simulations do the same, though they aren’t malicious. But how do phishers and faux phishers get you to click? Their “lures” include:

• Microsoft password expiration
• System update
• Password expiration
• LinkedIn search appearance

And the most clicked phishing simulation topic …

• Microsoft deactivation of old OneDrive account

These phishing email subjects exploit urgency and familiarity. Attackers often impersonate trusted brands and services, pressuring recipients to act quickly before verifying the request. Always pause, inspect the sender and think before you click. And when in doubt, report it!