# Phishing Attacks Survey: Types, Vectors, and Technical Approaches
## 2 Literature Review  
This section contains a review of the relevant literature. At present, several papers exist regarding phishing; of these, the most recent and comprehensive is that of [PERSON] et al. [14]. However, there is an overall lack of published papers, as can be seen in Figure 4, which shows the number of phishing-related papers published per year by the Institute of Electrical and Electronics Engineers (IEEE). Figure 3: Examples of Steam phishing attempts. As [PERSON] et al. pointed out in their 2018 paper, researchers have tended to publish findings about anti-phishing techniques rather than discuss the phishing techniques themselves [14]. Nonetheless, a selection of reviews relating to phishing have been published in recent years [15; 16; 17; 18; 19]. Phishing has been described as having a lifecycle, that is, a phishing attack can be broken into stages [15; 16; 19]. These are often summarized as follows:  
1. Planning--this involves identifying the targets, the information sought, and creating/identifying the tools and techniques that will be used in the attack (such as emails with malicious links and the spoof sites these links direct to). 2. Phishing--the stage during which the identified targets are phished using the resources created in Stage 1. 3. Infiltration--depending on the method used, this stage will vary but it essentially consists of the response from the target and gaining access to the personal information sought. 4. Data collection and exploitation--this is the stage at which the phisher extracts the information sought and utilizes it to achieve the ends established during the planning phase. This often involves fraud whereby the attackers impersonate the victims to access their accounts, etc. Another common occurrence is the selling of this personal data on the online black market. 5. Exfiltration--finally, the phisher attempts to remove as much evidence of their attempt as possible (such as the deletion of fake sites). There may also be some analysis on the success of the attack and assessment of future attacks. [PERSON] et al. simplified this process to a three-stage lifecycle of planning (Stage 1 above), collection (essentially Stages 2 and 3 of the above lifecycle), and fraud (Stages 4 and 5 above) [20]. In 2014, [PERSON] [17] reviewed the literature related to phishing, damage caused by phishing techniques, anti-phishing techniques, and the effectiveness of these techniques. Although thorough, this paper did not provide details about the technical approaches of phishing and did not include more modern techniques such as QRishing. [PERSON]'s 2016 [18] paper provided a brief overview of phishing techniques, but more attention was given to anti-phishing techniques. The details of each method were also not comprehensively discussed, and a high-level overview was instead provided. [PERSON] (2012) [19] provided a detailed review of the literature regarding these anti-phishing techniques through the analysis of 358 papers and 16 doctoral level theses. This review also focused almost solely on the preventative and protective measures rather than the technical approaches used by the phishers. It found that current anti-phishing techniques were widely deployed across the internet, and that all of the current approaches were purely preventative measures. Other papers have also explained phishing in relation to the wider area of social engineering [8; 21]. Figure 4: Number of phishing papers published by year in IEEE (the Institute of Electrical and Electronics Engineers) Access. In 2007, [PERSON] examined the emergence of new phishing techniques in the banking sector [22]. These techniques were grouped into four categories [23]:  
* The magnet method
* The rod and reel method
* The lobsterpot method
* The gillnet phishing method  
Of these categories, magnet phishing is the use of spam email to target a mass audience, which causes pop-ups or websites bearing legitimate identity elements (e.g., logos) to illicit an immediate response.