Phishing Playbook 2025
Phishers don’t need zero-days—just urgency, trust, and a link. Here are the ten patterns you’ll actually face in 2025, with quick tells and defenses you can apply today.
The 10 patterns (and how to kill them)
1) “Password reset” mirroring
Pixel-perfect clones of big sites. Tell: domain is off by a letter; link uses tracking/redirects. Defense: type the site address yourself; use passkeys.
2) Payroll & HR changes
Fake forms to reroute salary/benefits. Tell: asks for full SSN or bank login. Defense: company portal only; approvals require two people.
3) CEO/CFO “urgent wire”
Business-email compromise via lookalike domains. Tell: secrecy + gift cards/wires. Defense: out-of-band confirmation; vendor-banking changes require a call.
4) MFA fatigue & push bombing
Attackers spam approve prompts. Tell: multiple pushes at odd hours. Defense: number-matching; device-bound passkeys; report to IT.
5) Delivery/Customs smishing
Small “fee” links. Tell: short-lived domains; generic tracking IDs. Defense: use the courier app directly.
6) Cloud-share lures
“View the document” from unknown sender. Tell: file owner mismatch. Defense: open your drive and search the title; don’t follow email links.
7) Support-chat impersonation
Fake chat widgets or social DMs. Tell: asks for 2FA code or remote-control tool. Defense: support will never ask for codes.
8) Crypto/refund baits
“Unusual charge—claim refund.” Tell: QR wallet or “download refund app.” Defense: call card issuer from the number on the card.
9) QR code swaps
Posters/menus replaced with malicious QR. Tell: sketchy URL after scan. Defense: preview link; use a trusted menu/app.
10) AI-voiced relatives/co-workers
Voice clones ask for money/access. Tell: can’t answer a specific shared detail. Defense: use a family “safe word.”
Fast defenses you can deploy today
- Move critical logins to passkeys; kill SMS 2FA where possible.
- Use a password manager—auto-fill won’t trigger on fake domains.
- Patch browser + OS; enable automatic updates.
- Mail rules: flag external senders; block attachment macros; sandbox unknown links.
- Money moves: no wires without a voice call using a known number.
Spot-the-phish checklist
| Signal | Why it’s bad | Action |
|---|---|---|
| Urgency + secrecy | Short-circuit thinking | Pause; call back on a saved number |
| Lookalike domains | Typos/extra characters | Open the site manually |
| Attachment you didn’t expect | Malware macros | Ask the sender; open in cloud viewer |
| Requests for 2FA codes | Never legitimate | Refuse; report |
