## 2 Materials and Methods
### Types of Attacks, Exploited Vulnerabilities, and Countermeasures
#### 2.1.1 Types of Attacks  
**Phishing emails** are deceptive messages crafted to appear as if they come from legitimate sources intending to trick the recipients into revealing sensitive information or performing actions that benefit the attacker [1]. These emails often exploit psychological manipulation and social engineering tactics to bypass users' cognitive defenses. Understanding the underlying concepts of phishing emails and the factors that make users susceptible is crucial for developing effective countermeasures. Phishing emails typically include elements designed to create a sense of legitimacy and urgency. These elements can range from the use of logos and branding that mimic well-known organizations to the inclusion of urgent messages or threats that prompt immediate action. Phishing emails may also contain malicious links or attachments that, when clicked or opened, can lead to the installation of malware or direct the user to fraudulent websites designed to capture personal information [2].  
**Social engineering** is a manipulation technique that exploits human psychology to gain unauthorized access to information, systems, or physical locations [16]. It involves tricking individuals into divulging confidential information or performing actions that compromise security by exploiting their natural tendencies and emotional responses.  
A particularly relevant type of phishing is called **spearphishing**, where attackers tailor their deceptive messages to specific individuals or organizations [17]. Unlike generic phishing emails, spearphishing attacks use personalized information to make the email appear more legitimate and relevant to the recipient. This information can be gathered from social media profiles, public databases, or previous breaches. The personalized nature of spearphishing makes it more difficult to detect and significantly increases its success rate. Spearphishing emails often exploit the victim's personal connections, job role, or interests to create a sense of trust and urgency, making it a highly effective form of cyberattack [1]. Several factors contribute to why users fall victim to spearphishing emails, encompassing psychological, behavioral, and contextual elements. Understanding these factors can help in designing more effective prevention and education strategies.  
A **phishing campaign** is a coordinated effort by malicious actors to send fraudulent messages, often via email, to a large number of recipients intending to deceive them into revealing sensitive information or installing malware. These messages often appear legitimate, mimicking trusted entities like banks, social media platforms, or colleagues, to trick recipients into taking actions such as clicking malicious links or providing personal data. Phishing campaigns can target specific individuals or even broad groups, depending on the attackers' objectives. The goal is typically to gain unauthorized access to systems, steal financial information, or gather data for further exploitation. Effective phishing campaigns leverage social engineering techniques to exploit human vulnerabilities, making them a significant threat to both individuals and organizations.