You get an email that looks like it's from Microsoft. "Your session expired, click here to log in." The page is pixel-perfect — same logo, same layout, same fonts. You enter your password. Except the URL was micro-soft-verify.com, and your credentials just went to someone in another country.
Over 80% of reported security incidents involve phishing. The average phishing page exists for less than 24 hours — just long enough to harvest credentials, but short enough to avoid blocklist detection. That timing gap is exactly what makes phishing so effective.
The concept is old. The execution keeps getting better. An attacker clones a login page — your bank, your email, your SaaS tools — and tricks you into typing your real credentials into the fake version. The fake page forwards your login to the attacker, and in advanced setups, proxies you through to the real site so you don't even realize anything happened.
No malware. No downloads. No code running on your machine. Just a convincing-enough webpage and a moment where you don't look closely at the URL bar.
You receive an email, text message, or link that appears to come from a trusted source — your bank, employer, or a service you use. The message creates urgency: "Your account has been compromised," "Verify your identity," or "Payment failed."
The link takes you to a page that looks identical to the real service. The domain may look similar (like "paypa1.com" instead of "paypal.com") or use a subdomain trick (like "paypal.com.attacker.site"). Modern phishing kits clone entire login pages in minutes.
When you enter your username and password, the phishing page sends your credentials to the attacker's server. Advanced kits also capture 2FA codes in real time, using them within seconds to log into your real account.
The attacker now has your credentials. They log into your real account, change the password, and begin exfiltrating data, making unauthorized purchases, or using your account to attack others.
An email claims your Microsoft 365 session expired. The link goes to a page that looks exactly like the Microsoft login — same logo, same layout, same input fields. But the URL is "microsoft365-verify.com" instead of "microsoft.com". You enter your password. The attacker now has access to your email, OneDrive, and Teams.
A text message says "Unusual activity detected on your account. Verify your identity: [link]." The page is a perfect clone of your bank's login. It even asks for your SMS verification code and relays it in real time to log into your actual bank account.
A Discord message offers a free NFT mint. The connected site asks you to "connect your wallet" and approve a transaction. The transaction actually grants the attacker unlimited access to transfer your tokens. Your wallet is drained within minutes.
The examples above are the classic shapes. These are campaigns from 2026, each with what made it convincing and what would have given it away:
github.io.For the email side, see how to spot a phishing email that looks legitimate, and for phones, why a phishing site can look safe on desktop but not on a phone.
paypa1.com), extra subdomains (paypal.com.attacker.site), or unfamiliar domains entirely.What is a phishing attack?
A phishing attack is a scam that tricks you into handing over passwords, card details or other sensitive information, usually by pretending to be a company or person you trust. It typically starts with an email, text or social media message that links to a fake website built to look like the real one.
What are the most common types of phishing attacks?
Email phishing sent to many people at once; spear phishing aimed at one person or company; smishing by text message; vishing by phone call; quishing through QR codes; and business email compromise, where attackers pose as a colleague or supplier to redirect a payment.
Can phishing happen on HTTPS sites?
Yes. Most phishing pages now use HTTPS with valid SSL certificates from free providers like Let's Encrypt. The padlock icon only means the connection is encrypted — it says nothing about whether the site is legitimate. Always check the actual domain name.
Why doesn't my antivirus catch phishing?
Antivirus scans files on your computer for malware signatures. Phishing doesn't involve malware — it's a normal-looking web page that tricks you into entering credentials. There's no malicious file to detect. Browser-based tools like PhishClean analyze page content directly, which is where phishing actually happens.
Can phishing get past two-factor authentication?
Some can. Advanced phishing kits sit between you and the real site, pass your password and one-time code through in real time, and capture the signed-in session that follows. Hardware security keys and passkeys resist this, because they only work on the genuine domain.
What should I do if I entered my password on a phishing page?
Act fast: change the password on the real site immediately, change it on any other sites where you used the same password, enable two-factor authentication, check your account for unauthorized activity, and contact your bank if financial data was involved. Attackers often use stolen credentials within minutes. Our step-by-step recovery guide covers each case.
How do I report a phishing attack?
Use the Report phishing option in your email app, and tell the company being impersonated. In the US you can report it to the FTC at reportfraud.ftc.gov; in the UK, forward suspicious emails to the NCSC's Suspicious Email Reporting Service; in India, report it at cybercrime.gov.in or call 1930. If you lost money, contact your bank straight away.
When the site is real but the script stealing your data isn't — the other side of credential theft.
Phishing often pairs with HTTPS downgrades on public WiFi to intercept credentials.
Why blocklists miss most new phishing pages, and what catches them instead.
How two different approaches to browser security compare.
What happens after the credentials are stolen — how attackers take over active sessions.
Already clicked the link? Step-by-step damage control guide.
PhishClean analyzes every page you visit with 20 detection signals — locally, in real time. Your passwords and page content stay on your device.
Install PhishCleanLast updated: