A working map of how phishing actually happens

Adversaries impersonate media platforms—including streaming services, TV channels, and radio stations—to harvest credentials or payment details. Lures include fake alerts, giveaways, and subscription notices.

Threat actors impersonate major email providers such as Gmail or Outlook to trick users into entering credentials on phishing sites. Common tactics include fake security alerts about unusual account activity, warnings about full inbox storage, or deceptive messages urging password resets. These attacks aim to gain access to victims’ emails, which are then used for further phishing, fraud, or account takeovers.

Attackers mimic real cryptocurrency services to advertise fake airdrops and giveaways, luring victims into revealing wallet credentials or passphrases. Scams often promise free tokens, investment multipliers, or exclusive access to new projects, tricking users into signing malicious transactions or providing their private keys.

Attackers impersonate airlines, toll services, and other transport-related companies to deceive victims into submitting payment information. Common tactics include fake flight booking confirmations, toll payment notices, and fraudulent travel reward programs aimed at stealing credit card details or login credentials.

Attackers impersonate document sharing platforms such as Google Drive, Dropbox, and DocuSign to trick victims into opening malicious links or entering credentials. Common tactics include fake document signing requests or urgent shared file notifications. Victims are directed to phishing sites resembling legitimate login pages, allowing attackers to harvest credentials and gain access to sensitive files.

Attackers impersonate delivery services such as FedEx, UPS, or national postal services to steal sensitive information or payment details. These attacks often involve fake delivery failure notices, customs fee requests, or package tracking links leading to credential-harvesting sites. Victims may be asked to enter personal information, payment details, or login credentials.

Threat actors pose as banks, credit unions, or payment processors to steal financial credentials, personal information, or payment details. These attacks often involve urgent alerts about account security, fraudulent transactions, or account suspension notices, coercing victims into disclosing login credentials or transferring funds.

Attackers impersonate social media platforms to trick users into revealing account credentials. Common scenarios include fake notifications about password resets, accusations of violating platform guidelines, or alerts about suspicious account activity, leading users to phishing sites.

Attackers impersonate Microsoft services by sending fake security notifications, account suspension alerts, or prompts for urgent software updates to trick victims into revealing their login credentials.

Attackers impersonate hosting providers, sending fake domain expiration alerts, renewal notices, or suspension warnings to steal credentials or payment details.

Attackers impersonate AI service providers, such as OpenAI, claiming that a victim's payment details are incorrect or that their subscription is about to expire. These phishing attempts often include fake renewal notices or warnings of service disruption, leading victims to enter their login credentials and payment information on fraudulent websites.

Scammers impersonate telecom providers, claiming issues with recent payments, duplicate billing, or outstanding invoices. Victims may receive fake notifications stating they have overpaid their bill and are eligible for a refund or that their account has an unpaid balance requiring immediate action. These attacks often include links to fraudulent payment portals designed to steal banking credentials, credit card information, or login details. Attackers exploit urgency and trust in telecom services to manipulate victims into financial losses.

Attackers impersonate corporate benefits programs, employee perks providers, or government welfare services to deceive victims into sharing personal and financial information. Common attacks include fake emails offering exclusive discounts, free gadgets, or bonus incentives as part of an employee benefits package. Victims may be directed to fraudulent portals requiring login credentials or payment details to 'claim' their rewards, leading to credential theft or financial fraud.

Attackers impersonate corporate collaboration platforms such as Microsoft Teams, Zoom, Slack, or Yammer to trick employees into revealing login credentials or downloading malicious files. These attacks often involve fake meeting invitations, security alerts, or urgent system updates requiring the victim to log in via a phishing portal. Victims who enter their credentials into a fake login page risk compromising not only their accounts but also internal company communications and sensitive data.

Attackers impersonate utility companies, oil and gas providers, and power grid operators to steal payment details or sensitive information. Common attacks include fake overdue bill notices, service disconnection threats, and fraudulent investment opportunities in energy projects. Victims may be tricked into updating billing details on phishing sites or making payments to attacker-controlled accounts.

Attackers mimic Apple services with fake billing alerts or iCloud access issues to harvest credentials and payment data.

Threat actors impersonate Google services using alerts about suspicious sign-ins or storage limits to steal account credentials.

Attackers mimic Enterprise platforms such as SAP, Oracle, or Microsoft Dynamics to deceive employees into disclosing sensitive business information, login credentials or executing fraudulent transactions. These phishing messages often appear as invoice notifications, payment requests, or access alerts, exploiting the familiarity and authority of ERP systems within an organization.

Adversaries mimic hospitals, insurers, or patient portals with lab, billing, or coverage alerts to steal PHI, credentials, or payment information.

Attackers pose as tax, legal, or law enforcement authorities to manipulate victims into providing sensitive information, making payments, or complying with fraudulent demands.

Attackers impersonate executives, IT, or HR personnel to manipulate employees into divulging credentials, transferring funds, or executing unauthorized actions under a false sense of urgency.

Attackers impersonate government bodies to exploit public trust and authority. Victims are prompted to take urgent action—such as submitting payments or forms—via emails mimicking official communication.

Attackers exploit job seekers by creating fraudulent job listings, sending fake employment offers, or impersonating recruiters from reputable companies. Some campaigns can seek to harvest personal and banking details under the pretense of processing payroll or direct deposits, and others use fake interviews to elicit sensitive information or trick victims into transferring money under the guise of employment-related fees.

Attackers deceive victims with fraudulent promises of financial gain, such as investments, inheritances, or lottery winnings, requiring upfront payments or personal details to claim the supposed reward.

Attackers use fake promotions, counterfeit products, or misleading advertisements to trick victims into making payments or revealing sensitive information.

Attackers impersonate academic publishers or journals, soliciting research paper submissions. Victims unknowingly provide valuable content to illegitimate outlets that profit from unauthorized publication or misuse of intellectual property.

Attackers send fraudulent invoices, claiming unpaid bills or subscription renewals, to trick victims into making payments or revealing financial details.

Attackers impersonate legitimate vendors, suppliers, or manufacturers to deceive organizations into making fraudulent payments or providing sensitive business information. Common methods include sending fake Requests for Quotations (RFQ) or Requests for Proposals (RFP), tricking procurement teams into engaging with fraudulent contracts. These attacks exploit trust in established supply chain relationships, often targeting industries reliant on vendor partnerships and contractual agreements.

Attackers use fabricated legal threats, data leaks, or personal blackmail claims to coerce victims into making urgent payments or revealing sensitive information under pressure.

Attackers offer or dangle data they obtained illegitimately: attendee lists from conferences the recipient attended, contact databases of industry decision makers, competitor or customer records, leaked internal documents, or stolen credentials. The lure asks the recipient to buy the data, pay to have their own data removed from sale, or open a sample. The lists are scraped, recycled, or invented, and an attached "sample" can carry the actual payload.

Scammers send phishing messages claiming the victim has received an unexpected Bitcoin or cryptocurrency deposit that must be withdrawn within a limited time. These attacks often include fake login portals that harvest wallet credentials or seed phrases. In some cases, victims are asked to 'verify' their account by entering their private keys, ultimately leading to the theft of their funds. Attackers exploit urgency and financial incentive to pressure victims into making quick decisions.

Attackers send fake voicemail notifications, tricking victims into visiting credential-harvesting sites.

Fraudulent fax alerts prompt victims into entering credentials on phishing sites or downloading malicious attachments.

Fake surveys lure victims into providing personal or financial information under the pretense of rewards or market research.

Victims receive fake invitations to webinars, conferences, or training events. The email includes registration or calendar links that lead to further social engineering or payloads.

Attackers pose as love interests on dating apps, social media, or fake dating sites—often using “hot singles in your area” ads—to build trust and exploit victims for money or sensitive data.

Adversaries spread false narratives to manipulate public perception, deceive victims, or support fraudulent schemes for financial or ideological gain.

Victims receive fake notifications claiming their mailbox or cloud storage is full. The email urges them to manage space or upgrade their plan, linking to phishing pages that steal credentials.

Emails warn that a user's password is about to expire. The message prompts immediate action to reset or extend access, leading to malicious login pages designed to harvest credentials.

Victims receive fake MFA verification emails claiming login attempts or device changes. The message urges them to verify access or approve a request, leading to phishing sites that capture credentials or MFA codes.

Attackers send alerts claiming the recipient's account will be deleted due to inactivity or policy violations. Victims are pressured to act immediately by logging in to prevent termination, exposing credentials.

Fake alerts warn of login attempts from unknown devices or locations. Victims are urged to secure their account by verifying recent activity through a malicious link.

Emails claim urgent security patches or policy updates are required. Victims are told to log in and review the changes, directing them to fake portals that collect credentials.

Messages request an urgent update of billing, contact, or security information to avoid service disruption. Victims are led to phishing forms impersonating legitimate pages.

Victims are notified that important emails have been quarantined or held for review. The message includes a “release” or “review” button that links to credential-harvesting pages.

Emails alert users to a confidential or encrypted message requiring login to view. Victims are tricked into opening fake secure messaging portals that collect their credentials.

Threat actors craft phishing messages that mimic authentication-related notifications, prompting users to take urgent action such as 'Activate your account,' or 'Verify your identity,'. These messages often imitate trusted services and aim to harvest credentials, redirect users to malicious login portals, or trick them into approving unauthorized access attempts.

Fake email delivery failure notifies the user that their email has failed to send. Victims are prompted to log in, allowing attackers to steal credentials using lookalike login pages.