What are the main types of phishing attacks?

Phishing attacks differ by delivery and by target. MITRE ATT&CK splits delivery into four types: malicious attachments, malicious links, messages sent through third-party services, and voice calls. Targeting is either mass, sent to anyone, or spearphishing, aimed at a specific person, company or industry.

How does MITRE organize phishing?

ATT&CK lists technique T1566, Phishing, under the Initial Access tactic, with four sub-techniques: spearphishing attachment, spearphishing link, spearphishing via service, and spearphishing voice. It also lists T1598, Phishing for Information, which sits under Reconnaissance. The difference is the goal. T1566 tries to run code on the victim's system. T1598 tries to get the victim to hand over information, often credentials.

MITRE's framing is useful because it stops you from thinking of phishing as just email. A control that only watches the inbox leaves three of the four delivery routes untouched.

What does each type look like?

Attachment. A file arrives that is built to execute something when opened. A constructed example: an "unpaid invoice" spreadsheet that asks the reader to enable content.

Link. The message points to a page that looks like a login portal. CISA's own example describes a "payment failed" email with a shortcut link to a lookalike vendor site and a demand to sign in immediately. The attacker captured the password and card data.

Via service. The lure comes through a social platform, a collaboration tool or even a calendar invite, not through your mail gateway. ATT&CK notes calendar invites explicitly.

Voice. The message tells you to call a number. The person on the line then walks you to a malicious site, has you download a file, or has you install a remote management tool. ATT&CK documents this as callback phishing.

Thread hijacking. An attacker adds your address to an existing email thread that already contains malicious links or files. The conversation looks real because it is.

Why does "spear" matter?

Mass phishing relies on volume. Spearphishing relies on research: your manager's name, a project you really work on, a vendor you really pay. CISA notes that poor grammar used to be a common tell, but with AI some messages now arrive with perfect spelling, so you must lean on other signs: urgent or emotional language, requests for personal or financial information, shortened URLs, and sender addresses or links that are slightly wrong.

What defenses map to which type?

• Attachment: block risky file types you do not need, and scan files before delivery.
• Link: expand and inspect URLs, and use phishing-resistant sign-in so a stolen password is not enough.
• Via service: apply the same reporting and inspection rules to chat, social and calendar.
• Voice: callback verification. Look up the number yourself and never use the one in the message.
• Spoofed sender: SPF, DKIM and DMARC email authentication, which ATT&CK lists as a mitigation.

User training appears in ATT&CK's mitigations too, but it is one layer, not the plan.

How to check or apply this

1. Inventory the channels where staff receive messages: email, chat, social, phone, calendar invites.
2. Confirm SPF, DKIM and DMARC are set up on your sending domains.
3. Make "report phish" one click in the mail client, and tell people what happens after they click it.
4. Add a rule for payment and credential requests: confirm through a second channel you chose, not the one in the message.
5. Run a tabletop exercise on a callback scam, since fewer teams practice it.
6. Review sign-in methods for high-value accounts and move them to ones that a lookalike page cannot replay.

Quick check

Sources

• MITRE ATT&CK: Phishing, T1566
• MITRE ATT&CK: Phishing for Information, T1598
• CISA: Recognize and Report Phishing

Last reviewed: 18 October 2026.