Phishing is a cyberattack in which a criminal impersonates a trusted organisation or person to trick someone into revealing credentials, payment details or other sensitive data, or into sending money directly. The lure is usually a message: an email from a bank, a text about an unpaid toll, a call from "IT support", or a search ad leading to a copy of a login page. It exists because deceiving a human is cheaper than breaking encryption.

The scale is large. The Anti-Phishing Working Group (APWG), an industry consortium, counted 1,069,681 unique phishing sites in the second quarter of 2026, up 10.1% from 971,181 in the first quarter, according to its report published on August 28, 2026. June's total of 425,808 was the highest monthly figure since April 2023.

How a phishing attack works

A typical campaign has four parts. The first is the lure, a message that borrows a brand's name and logo and supplies a reason to act now, such as a suspended account or an overdue invoice. The second is the landing page, a copy of the genuine login or payment screen hosted on a lookalike domain, a compromised website or a free hosting service. The third is capture, when the victim types a username, password, card number or one-time code. The fourth is monetisation: draining an account, reselling access, launching ransomware or using the hijacked mailbox to phish the victim's contacts.

Lookalike domains carry much of the deception. Attackers register names that swap a letter, add a hyphen or append words such as "group" or "support", a technique known as typosquatting. Others abuse high-reputation services. Cloudflare's 2026 threat report described attackers using Google Drive and Azure to slip past filters, and found that nearly 46% of emails analysed failed DMARC checks.

Multi-factor authentication (MFA) raised the cost of phishing but did not end it. Adversary-in-the-middle (AiTM) kits sit between the victim and the real service, relaying each screen in real time. When the victim enters a password and a code, the proxy passes both to the genuine site and keeps the resulting session cookie, which lets the attacker log in without either. Microsoft said on July 12, 2022, that one AiTM campaign had attempted to target more than 10,000 organisations since September 2021. Stolen cookies lead directly to session hijacking.

These kits are rented, not built. Phishing-as-a-service operators sell templates, hosting and admin panels by subscription. Tycoon 2FA, an AiTM kit, cost $120 for 10 days or $350 a month, according to The Hacker News. Microsoft estimated it had about 96,000 victims from 2023 until a Europol-led operation took down 330 of its domains in March 2026.

Email, SMS, voice and search variants

Email phishing remains dominant. In Verizon's 2026 Data Breach Investigations Report (DBIR), email was the vector in 98% of social engineering cases, and phishing was the initial access route in 16% of breaches, behind vulnerability exploitation at 31%, according to SC Media's summary of the report.

Spear phishing targets a named individual with researched detail. Whaling aims at senior executives. Clone phishing copies a genuine message the victim has already received and swaps the link. Business email compromise (BEC) often begins with a phished mailbox and ends with a fraudulent wire transfer; the average BEC wire request rose 45% to $61,732 in the second quarter of 2026, according to the APWG.

Smishing (SMS phishing) rose 40% between the first and second quarters of 2026, and vishing (voice phishing) rose 20%, according to the same APWG report. Simulation subjects were 40% more likely to fall for mobile lures than for email ones, according to SC Media's DBIR summary. Quishing hides the link in a QR code, which many email filters cannot read.

Search ads are another delivery route. On October 7, 2026, an analytics engineer searched for "cloud console", clicked a Google Ads listing and landed on a reverse-proxy copy of Google's login flow at a lookalike domain. Paid placements that serve such pages fall under malvertising.

Origin and evolution

The word dates from around January 1996, when it appeared on the alt.2600 hacker newsgroup, according to Computerworld. Hackers were stealing America Online (AOL) passwords with fake billing and support messages; the hacked accounts were the "phish", and by 1997 they were traded among hackers as currency. The "ph" spelling nods to phone phreaking, the telephone hacking culture of the 1970s.

The attacks moved to banks and payment services in the early 2000s, and the APWG was formed in 2003 to pool data. Prosecutors followed. On January 16, 2007, a federal jury in Los Angeles convicted Jeffrey Brett Goodin, who had sent thousands of emails posing as AOL's billing department, in the first conviction under the CAN-SPAM Act of 2003, according to the US Department of Justice.

Standards bodies addressed the root weakness: email's "From" line can be forged. Domain-based Message Authentication, Reporting and Conformance (DMARC), published as RFC 7489 in March 2015, lets a domain owner instruct receiving servers to quarantine or reject mail that fails Sender Policy Framework (SPF) or DomainKeys Identified Mail (DKIM) checks. In May 2026, the Internet Engineering Task Force (IETF) replaced it with RFC 9989, known as DMARCbis, a Standards Track revision that retires the "pct" tag and swaps the Public Suffix List for a DNS "tree walk", according to email security firm Palisade.

Defences: DMARC, BIMI and passkeys

Mailbox providers turned authentication from optional to compulsory. Gmail and Yahoo required bulk senders to deploy SPF, DKIM and DMARC from February 1, 2024, with a spam rate below 0.3%. Microsoft applied similar rules to Outlook.com from May 5, 2025, routing non-compliant mail from domains that send more than 5,000 messages a day to junk.

Brand Indicators for Message Identification (BIMI) builds on DMARC. A domain that enforces DMARC can display its logo beside messages, and Gmail has shown a blue checkmark since May 3, 2023 for senders holding a Verified Mark Certificate, which requires a registered trademark.

Authentication of the user is the other front. Passkeys are bound cryptographically to the genuine domain, so a proxy page cannot collect them. Google Ads began requiring a passkey for account linking and user access changes from July 15, 2026, citing "the risk of phishing and unauthorized access".

Why it matters for marketers

Marketing teams are both impersonated and targeted. Brands lend their names to lures, and the most targeted sectors in the second quarter of 2026 were software-as-a-service and webmail at 29.1% of attacks, payment services at 13.2% and financial institutions at 11.4%, according to the APWG.

Ad accounts are prizes in their own right. They hold stored payment methods, client data and reach. In April 2026, agencies reported fake client inquiries from a domain registered three days earlier, aiming to get linked to their manager accounts. Google's Ginny Marvin said phishing was "a common method to gain unauthorized access to accounts". In January 2026, marketers received invitations to beta-test a non-existent "OpenAI Advertising GPT".

The ad platforms are also enforcement bodies. Google reported blocking or removing 8.3 billion ads in 2025, 602 million of them tied to scams, and has allowed immediate suspension of advertisers that impersonate other brands since March 2024.

Limitations and disputes

Counting phishing is hard. The APWG counts unique sites, not victims. The FBI's Internet Crime Complaint Center (IC3) recorded about 192,000 phishing and spoofing complaints in 2025 with losses above $215 million, according to Fast Company, a small share of the $20.877 billion in total reported losses. Phishing frequently opens the door to crimes classified elsewhere, such as BEC or investment fraud, so category totals understate its role.

Training is contested. Critics of click-based simulation programmes argue that blaming employees ignores design failures, such as login flows that accept a password on any lookalike page. DMARC protects an exact domain, not the thousands of lookalikes an attacker can register, and a strict "reject" policy can block legitimate forwarded mail.

Platform incentives draw scrutiny too. Reuters reported that internal Meta projections attributed roughly $16 billion of 2024 revenue to scam and banned-goods ads, and that suspected fraudsters below a 95% certainty threshold were charged higher rates rather than removed. Meta called the figure "rough and overly-inclusive".

Not the same as

Social engineering is the wider category of manipulating people. Phishing is the message-based subset; a help desk impersonation call or tailgating into an office is social engineering without a phishing message.

Spam is unsolicited bulk messaging. Much spam is merely unwanted advertising; phishing is fraud, whatever its volume.

Malvertising uses paid ad placements to deliver malware or scam pages. A malvertising campaign can lead to a phishing page, but phishing also travels through email, SMS and calls with no ad involved.

Spoofing is the forging of a sender identity, such as a "From" address or caller ID. It is a technique phishing often relies on, not the attack itself. A botnet may send phishing at scale, but it is infrastructure rather than a lure.

Recent developments

Volumes are rising again. The APWG's second quarter 2026 figure followed two quarters of growth from 853,244 sites in the fourth quarter of 2025. Google sued the operators of Lighthouse, a phishing-as-a-service platform behind toll and parcel smishing texts, on November 12, 2025, under racketeering and fraud statutes, saying it had more than 1 million victims in 120 countries.

Infrastructure keeps adapting. Cloudflare's 2026 report flagged phishing services that exploit mail relays which fail to re-verify senders, delivering "high-trust brand impersonations". For advertisers, the practical shift is toward phishing-resistant login: as of October 2026, passkeys guard the account changes attackers most want to make.

Timeline

  • Early 1970s - Phone phreaking culture emerges, later inspiring the "ph" spelling.
  • January 1996 - "Phishing" appears on the alt.2600 newsgroup in connection with AOL account theft.
  • 1997 - Phished AOL accounts are traded among hackers as currency.
  • 2003 - The Anti-Phishing Working Group is formed; the CAN-SPAM Act is passed.
  • January 16, 2007 - Jeffrey Brett Goodin becomes the first person convicted under CAN-SPAM, for AOL phishing.
  • March 2015 - DMARC is published as RFC 7489.
  • July 12, 2021 - BIMI becomes generally available in Gmail.
  • July 12, 2022 - Microsoft details an AiTM campaign that targeted more than 10,000 organisations.
  • May 3, 2023 - Gmail adds blue checkmarks for BIMI senders with Verified Mark Certificates.
  • February 1, 2024 - Gmail and Yahoo bulk sender authentication rules take effect.
  • May 5, 2025 - Outlook.com begins junking non-compliant high-volume mail.
  • November 12, 2025 - Google sues the operators of the Lighthouse smishing platform.
  • March 2026 - Europol-led operation takes down 330 Tycoon 2FA domains.
  • May 2026 - DMARCbis is published as RFC 9989.
  • July 15, 2026 - Google Ads requires passkeys for account linking and user access changes.
  • August 28, 2026 - APWG reports 1,069,681 phishing sites for the second quarter of 2026.

Summary

Who: Criminal groups and phishing-as-a-service operators run campaigns; banks, software platforms, delivery firms and ad platforms are impersonated; employees, consumers and agency staff are targeted. The APWG, mailbox providers, the IETF and law enforcement lead the response.

What: Phishing is the impersonation of a trusted party, by email, SMS, voice call, QR code or search ad, to steal credentials, payment data or money. Modern kits relay real login pages to capture MFA codes and session cookies.

When: The term appeared around January 1996 among AOL account thieves. DMARC followed in 2015, mandatory bulk sender authentication in 2024, and DMARCbis in May 2026. APWG counts reached 1,069,681 sites in the second quarter of 2026.

Where: Everywhere messages travel: inboxes, phones, messaging apps and search results. Google's lawsuit against Lighthouse cited victims in 120 countries.

Why: Deceiving a person is cheaper than breaking a system. For marketers, phishing threatens ad accounts and client access, exploits brand names, and makes email authentication a deliverability requirement as well as a security one.