International Journal of Science, Engineering and TechnologyAuthors: Rajguru Tejas Prakash, Prof. M. R. Kumbhoje, Prof. M. C. Kolse, Prof. S. K. Said
Abstract: Phishing remains one of the most common entry points for cyberattacks, tricking people into revealing credentials, installing malware or transferring money. Phishing has diversified far beyond mass emails into targeted spear phishing, executive whaling, SMS smishing, voice vishing, clone phishing, malicious websites and social-media lures. This paper reviews phishing from three perspectives. First, it classifies phishing types by channel and targeting. Second, it examines attacker techniques, including social engineering using information from social networks, look-alike domains through typosquatting and homograph characters, cloned websites, and modern adversary-in-the-middle toolkits that intercept credentials and one-time codes to bypass multi factor authentication, along with evidence on the lifecycle and effectiveness of real campaigns. Third, it reviews prevention strategies across technical controls, such as email authentication, phishing-resistant authentication, browser warnings and detection systems, and human measures, such as training and organizational reporting cultures. A five-layer defence-in-depth framework is proposed, together with research gaps, objectives, a comparison of authentication methods and challenges. The review concludes that no single control stops phishing, but layered technical and human defences greatly reduce its success.
DOI: https://doi.org/10.5281/zenodo.24215042
