# Phishing Attacks Survey: Types, Vectors, and Technical Approaches
## 1 Introduction
An example is a phishing scam that aimed to steal the user login credentials for Steam (a PC gaming platform) by offering a \"free skin giveaway\" (Figure 3). The scam was initiated by a comment left on a user's profile, which once clicked directed the victim to the  
Figure 1: Number of unique phishing websites between 2013 and 2019. Figure 2: Targeted attack infection vectors (Anti-Phishing Working Group). phishing site with information about the giveaway and even a fake scrolling chat bar to give an impression of legitimacy. Here the victim was prompted to \"login via Steam\", which took them to a fake login screen where their credentials were captured. The attack extended to generating a real Steam guard code (i.e., two-factor authentication), which granted the phisher access to the victim's account to sell items and further promote the scam (see Figure 3) [11]. MMOs (massive multiplayer online games) are also a common target for phishers as \"loot box\" style goods can be sold on the online black market. An example of this type of phishing scam recently targeted the MMO Elder Scrolls Online [12]. Phishing also played a part in the first successful cyber attack on a power grid, which took place in Ukraine in December of 2015. IT staff and network administrators of various companies that handled power distribution for Ukraine were targeted with spear phishing attacks. The attack involved a malicious Microsoft Word document that provided a prompt to enable macros. Once clicked, the macro installed the malware BlackEnergy3 on the system, thus providing a backdoor for the attackers. This eventually resulted in the successful shutdown of 30 substations and left 230,000 people without power for up to six hours. This example demonstrates how powerful and devastating a well-planned and well-executed phishing attack can be. It is also clear even trained IT professionals cannot always identify these types of attacks [13]. The above discussion indicates that phishing is a major problem that needs to be comprehensively understood to be combated. Therefore, this paper reviews a broad range of characteristics from classic, current, and cutting-edge phishing techniques, including identifying areas in which anti-phishing techniques are missing or lacking. It is also hoped that this paper will encourage the adoption of preventative phishing practices by raising the awareness of the types of phishing techniques that exist, especially on an individual level. To foster better understanding, the phishing techniques discussed in this paper are split into three key groups that are interconnected. These are:  
1. The medium
2. The vector
3. The technical approach  
This grouping is used to highlight the fact that certain vectors can be used on certain media and only specific technical approaches can be used on specific vectors. The remainder of the paper is broken down into various sections. Section 2 consists of a literature review containing information about the different types of phishing approaches. Section 3 outlines the various phishing methods and techniques. Section 4 details the various phishing resources, Section 5 outlines the more general anti-phishing techniques, Section 6 outlines phishing in relation to cyber resilience, Section 7 discusses the current challenges and trend of phishing attacks, and finally, Section 8 contains the concluding remarks.