# Phishing attacks

> Learn how phishing attacks work, see real-world examples, and discover how PhishClean's 27 detection signals protect your browser in real time.

Canonical: https://www.phishclean.com/threats/phishing-attacks
Last updated: 2026-11-06

You get an email that looks like it's from Microsoft. "Your session expired, click here to log in." The page is pixel-perfect — same logo, same layout, same fonts. You enter your password. Except the URL was micro-soft-verify.com, and your credentials just went to someone in another country.

Over 80% of reported security incidents involve phishing. The average phishing page exists for less than 24 hours — just long enough to harvest credentials, but short enough to avoid blocklist detection. That timing gap is exactly what makes phishing so effective.

## How phishing actually works

The concept is old. The execution keeps getting better. An attacker clones a login page — your bank, your email, your SaaS tools — and tricks you into typing your real credentials into the fake version. The fake page forwards your login to the attacker, and in advanced setups, proxies you through to the real site so you don't even realize anything happened.

No malware. No downloads. No code running on your machine. Just a convincing-enough webpage and a moment where you don't look closely at the URL bar.

## How a phishing attack works

1

### The lure

You receive an email, text message, or link that appears to come from a trusted source — your bank, employer, or a service you use. The message creates urgency: "Your account has been compromised," "Verify your identity," or "Payment failed."

2

### The fake page

The link takes you to a page that looks identical to the real service. The domain may look similar (like "paypa1.com" instead of "paypal.com") or use a subdomain trick (like "paypal.com.attacker.site"). Modern phishing kits clone entire login pages in minutes.

3

### Credential capture

When you enter your username and password, the phishing page sends your credentials to the attacker's server. Advanced kits also capture 2FA codes in real time, using them within seconds to log into your real account.

4

### Account takeover

The attacker now has your credentials. They log into your real account, change the password, and begin exfiltrating data, making unauthorized purchases, or using your account to attack others.

## Real-world examples

### Fake Microsoft 365 login

An email claims your Microsoft 365 session expired. The link goes to a page that looks exactly like the Microsoft login — same logo, same layout, same input fields. But the URL is "microsoft365-verify.com" instead of "microsoft.com". You enter your password. The attacker now has access to your email, OneDrive, and Teams.

### Bank "security alert"

A text message says "Unusual activity detected on your account. Verify your identity: [link]." The page is a perfect clone of your bank's login. It even asks for your SMS verification code and relays it in real time to log into your actual bank account.

### Crypto wallet drain

A Discord message offers a free NFT mint. The connected site asks you to "connect your wallet" and approve a transaction. The transaction actually grants the attacker unlimited access to transfer your tokens. Your wallet is drained within minutes.

## Recent campaigns we've written up

The examples above are the classic shapes. These are campaigns from 2026, each with what made it convincing and what would have given it away:

- [GitBait](https://www.phishclean.com/blog/gitbait-github-pages-banking-phishing): fake bank logins hosted on GitHub Pages, so the address ends in a trusted `github.io`.
- [Ghost phishing](https://www.phishclean.com/blog/ghost-phishing-eviltokens-browser-blind-spot): pages that only decrypt inside your browser, so URL scanners see nothing.
- [Invisible Unicode](https://www.phishclean.com/blog/invisible-unicode-phishing-ascii-smuggling): emails that hide characters inside ordinary words to slip past filters.
- [The "purchase order" PDF](https://www.phishclean.com/blog/purchase-order-pdf-telegram-phishing) that was really an HTML login page sending passwords to Telegram.
- [Fake Google Meet updates](https://www.phishclean.com/blog/google-meet-update-device-enrollment-phishing) that enrol your PC in an attacker's device management.
- [Fake Google security checks](https://www.phishclean.com/blog/fake-google-security-pwa-phishing) that install a browser app to steal one-time codes.
- [Passkey enrolment by phone](https://www.phishclean.com/blog/entra-passkey-enrollment-vishing): callers walking employees through registering the attacker's passkey.
- [Zoning-permit fee emails](https://www.phishclean.com/blog/fbi-zoning-permit-phishing-scam) impersonating city planning officials, flagged by the FBI.
- [Malvertising extensions](https://www.phishclean.com/blog/chrome-extension-malvertising-wave) that inject redirects and fake prompts into normal sites.

For the email side, see [how to spot a phishing email that looks legitimate](https://www.phishclean.com/blog/how-to-spot-phishing-email-that-looks-legit), and for phones, [why a phishing site can look safe on desktop but not on a phone](https://www.phishclean.com/blog/why-a-phishing-site-can-look-safe-on-desktop-but-not-phone).

## How to protect yourself

- **Look at the URL, not the page.** The page will look perfect. The URL won't. Check for misspellings (`paypa1.com`), extra subdomains (`paypal.com.attacker.site`), or unfamiliar domains entirely.
- Password managers are underrated as a phishing defense. They only auto-fill on the correct domain. If you go to a fake Google login and 1Password doesn't offer to fill it, that's your signal. Trust the password manager over your own eyes.
- **Don't follow email links to login pages.** If an email says your account needs attention, open a new tab and go to the site directly. This one habit blocks the vast majority of phishing attacks.
- Hardware security keys (YubiKey, Google Titan) are the strongest 2FA option. Regular 2FA helps, but advanced phishing kits can proxy your TOTP codes in real time. Hardware keys use [cryptographic challenge-response](https://www.phishclean.com/threats/ssl-stripping-attacks) tied to the domain — they literally can't be phished.
- A browser extension like PhishClean catches what you miss. It checks form actions, domain mismatches, [hidden iframes](https://www.phishclean.com/threats/hidden-iframe-attacks), and more than a dozen other signals, in real time, on every page. The kinds of things a human wouldn't notice, a detection engine will.

## Frequently asked questions

What is a phishing attack?

A phishing attack is a scam that tricks you into handing over passwords, card details or other sensitive information, usually by pretending to be a company or person you trust. It typically starts with an email, text or social media message that links to a fake website built to look like the real one.

What are the most common types of phishing attacks?

Email phishing sent to many people at once; spear phishing aimed at one person or company; smishing by text message; vishing by phone call; [quishing](https://www.phishclean.com/threats/qr-code-phishing-attacks) through QR codes; and business email compromise, where attackers pose as a colleague or supplier to redirect a payment.

Can phishing happen on HTTPS sites?

Yes. Most phishing pages now use HTTPS with valid SSL certificates from free providers like Let's Encrypt. The padlock icon only means the connection is encrypted — it says nothing about whether the site is legitimate. Always check the actual domain name.

Why doesn't my antivirus catch phishing?

Antivirus scans files on your computer for malware signatures. Phishing doesn't involve malware — it's a normal-looking web page that tricks you into entering credentials. There's no malicious file to detect. Browser-based tools like PhishClean analyze page content directly, which is where phishing actually happens.

Can phishing get past two-factor authentication?

Some can. Advanced phishing kits sit between you and the real site, pass your password and one-time code through in real time, and capture the signed-in session that follows. Hardware security keys and passkeys resist this, because they only work on the genuine domain.

What should I do if I entered my password on a phishing page?

Act fast: change the password on the real site immediately, change it on any other sites where you used the same password, enable two-factor authentication, check your account for unauthorized activity, and contact your bank if financial data was involved. Attackers often use stolen credentials within minutes. Our [step-by-step recovery guide](https://www.phishclean.com/help/clicked-a-phishing-link) covers each case.

How do I report a phishing attack?

Use the Report phishing option in your email app, and tell the company being impersonated. In the US you can report it to the FTC at [reportfraud.ftc.gov](https://reportfraud.ftc.gov/); in the UK, forward suspicious emails to the NCSC's Suspicious Email Reporting Service; in India, report it at [cybercrime.gov.in](https://cybercrime.gov.in/) or call 1930. If you lost money, contact your bank straight away.

## Related threats & resources

- [Formjacking attacks](https://www.phishclean.com/threats/formjacking-attacks): When the site is real but the script stealing your data isn't — the other side of credential theft.
- [SSL stripping](https://www.phishclean.com/threats/ssl-stripping-attacks): Phishing often pairs with HTTPS downgrades on public WiFi to intercept credentials.
- [PhishClean vs Safe Browsing](https://www.phishclean.com/compare/phishclean-vs-chrome-safe-browsing): Why blocklists miss most new phishing pages, and what catches them instead.
- [PhishClean vs Browser Guard](https://www.phishclean.com/compare/phishclean-vs-malwarebytes-browser-guard): How two different approaches to browser security compare.
- [Session hijacking](https://www.phishclean.com/threats/session-hijacking-attacks): What happens after the credentials are stolen — how attackers take over active sessions.
- [After a phishing attack](https://www.phishclean.com/blog/what-to-do-after-phishing-attack): Already clicked the link? Step-by-step damage control guide.

For how phishing links are hosted today, see our [phishing URL statistics](https://www.phishclean.com/research/phishing-urls), counted from PhishTank's verified live list.

## Stop phishing before it starts

PhishClean analyzes every page you visit with 27 detection signals — locally, in real time. Your passwords and page content stay on your device.

[Install PhishClean](https://www.phishclean.com/#install)

Last updated: 6 November 2026