Skip to content
←Back to glossaryCyber

Phishing

Attack technique using fraudulent emails or messages to steal credentials or install malware, and the leading initial-access vector in cyber losses.

Definition

In September 2023, MGM Resorts shut down part of its systems after an intrusion attributed to Scattered Spider, which got in with a phone call to the IT help desk: the attacker posed as an employee and was handed access. MGM put the hit at about $100 million on its quarterly results (Form 8-K, October 5, 2023). That is phishing, by phone. Phishing relies on deception: a message that mimics a legitimate one gets the victim to hand over credentials, click a link or open a booby-trapped attachment. MITRE ATT&CK files it under initial access (T1566). It ranks among the top intrusion vectors in post-breach analyses, neck and neck, depending on the year and the source, with stolen credentials and internet-facing vulnerabilities. Variants differ by targeting. Mass phishing plays the numbers. Spear-phishing goes after a specific person or organization, built from what LinkedIn or the company website gives away. Whaling goes after executives, whose access is worth the most. Smishing runs over SMS, vishing over the phone, as at MGM. For the underwriter, it shows up in the application: email filtering, awareness training, and above all MFA, which limits the damage when a password leaks, provided the MFA itself is phishing-resistant; a help desk that resets a second factor on a phone call defeats it. When phishing feeds a payment fraud rather than an intrusion, the market often handles it separately, as social engineering, with its own sublimit.

Its 7 cross-references, woven across the glossary's 18 categories
Phishing: Cyber glossary illustration, AlgoPolis
Example

Textbook case: a spear-phishing campaign targeting the finance team of an industrial SME sends an email mimicking an urgent request from senior management to validate a wire transfer. An employee clicks the link, enters their Active Directory credentials, and the attacker uses the account to deploy ransomware 72 hours later.

Read next
CyberSpear phishingA personalized form of phishing aimed at a specific person or organization after reconnaissance, and the main gateway for attacks.Read the entry →CyberMFA (multi-factor authentication)Authentication mechanism requiring at least two distinct verification factors, drastically reducing the risk of account compromise even when credentials are stolen.Read the entry →CyberBusiness Email Compromise (BEC)An email scam impersonating an executive or a supplier to obtain a fraudulent transfer, with no malware involved.Read the entry →
Put it to work
SimulatorPlay this case from the underwriter's seatEight quarters, one book, cyber and political risk files. You set the price and the war clause, then the market answers back.Take the seat →
Related terms
Stay informed

Follow the research

One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.

No spam, one-click unsubscribe, no data ever sold.