Phishing
Phishing is a social engineering attack — attackers impersonate trusted brands to trick users into handing over passwords, card details or installing malware.
Stop Automated Phishing
Block bot-driven phishing campaigns
What is Phishing?
Phishing is deceiving someone into handing over credentials or money by impersonating a party they trust. It remains the most common way organisations are breached, and the reason is that it targets the person rather than the system — no vulnerability required.
The variants worth distinguishing
| Variant | Delivery | What makes it work |
|---|---|---|
| Bulk phishing | Mass email | Volume. A tiny response rate is still profitable |
| Spear phishing | Targeted email, researched | Specific detail: a real project, a real colleague's name |
| Business email compromise | Email from a genuinely compromised account | No spoofing to detect, because the sender is real |
| Smishing and vishing | SMS, voice calls | Urgency, and channels with weaker filtering |
| Adversary-in-the-middle | A relay proxy behind a convincing replica | Captures the session token, not just the password |
The last row is the one that has changed the landscape. The victim's credentials and their one-time code are both relayed to the real site in real time, and the attacker receives a live session. Phishing-awareness training does not stop it, because the user did everything they were taught to do and the site looked right.
What actually defends against it
Ranked by effect, which is roughly the inverse of how much attention each usually gets:
Phishing-resistant authentication. WebAuthn and hardware security keys bind the credential to the real origin, so a relayed signature is worthless on the genuine site. This is a structural defence rather than a procedural one, and it is the single highest-value change most organisations can make. See multi-factor authentication for how the factors compare.
Email authentication. SPF, DKIM and a DMARC policy set to reject stop others sending as your domain. It does not protect you from inbound phishing, but it stops your brand being the vehicle for someone else's.
Training. Useful for raising the floor and for building the reflex to report. Not a control you can rely on, because a well-made replica is not distinguishable by inspection and expecting staff to catch it shifts an engineering problem onto people.
Two real intersections with bot protection
Mostly not, and it is worth being clear rather than claiming the category. A CAPTCHA does not stop a phishing email.
There are two real intersections. Phishing kits are deployed and operated automatically, including the credential-relay proxies, so the automated replay of harvested credentials against your login is a bot problem — that is credential stuffing with a fresher list. And the account-recovery flows attackers use once they hold a password are exactly the endpoints that benefit from human verification.
So: WebAuthn for the phishing, a bot layer for what the attacker does with what they harvested.