Glosario de ciberseguridad
What is phishing?
Phishing is a fraud technique in which an attacker impersonates a trusted entity — bank, vendor, colleague or cloud service — to trick the victim into handing over credentials, sensitive data or running a malicious action.
How a phishing attack works
- The attacker crafts a message that mimics a legitimate sender.
- It includes a link to a cloned site or a malicious attachment.
- The victim enters credentials or runs the file.
- The attacker reuses those credentials to access real systems.
Most common phishing variants
- Spear phishing: targeted to a specific person with tailored info.
- Whaling: aimed at executives to approve transfers or leak data.
- Smishing: phishing over SMS.
- Vishing: voice calls impersonating tech support or officials.
- MFA phishing: fake pages that also capture the one-time code.
How a company protects itself
- Continuous training and internal simulations.
- Advanced email filtering (SPF, DKIM, DMARC).
- Remove reusable passwords with single encryption key authentication.
- Apply Zero Trust: even if a credential leaks, the attacker doesn't get into the network.