cve.bz

CAPEC-98

Phishing

Very High severityHigh likelihoodStandard pattern

Phishing is a social engineering technique where an attacker masquerades as a legitimate entity with which the victim might do business in order to prompt the user to reveal some confidential information (very frequently authentication credentials) that can later be used by an attacker. Phishing is essentially a form of information gathering or "fishing" for information.

On this page

Ask an AI about this attack pattern

ChatGPTClaudeGoogle AI Mode

Show the promptExplain the attack pattern CAPEC-98: Phishing: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/98.html and https://cve.bz/cve/capec/98?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.

How the attack unfolds

  1. Explore

    The attacker looks for a way in.

    1. [Obtain domain name and certificate to spoof legitimate site] This optional step can be used to help the attacker impersonate the legitimate site more convincingly. The attacker can use homograph attacks to convince users that they are using the legitimate website. Note that this step is not required for phishing attacks, and many phishing attacks simply supply URLs containing an IP address and no SSL certificate.

      2 techniques
      • Optionally obtain a domain name that visually looks similar to the legitimate site's domain name. An example is www.paypaI.com vs. www.paypal.com (the first one contains a capital i, instead of a lower case L)
      • Optionally obtain a legitimate SSL certificate for the new domain name.

    2. [Explore legitimate website and create duplicate] An attacker creates a website (optionally at a URL that looks similar to the original URL) that closely resembles the website that they are trying to impersonate. That website will typically have a login form for the victim to put in their authentication credentials. There can be different variations on a theme here.

      3 techniques
      • Use spidering software to get copy of web pages on legitimate site.
      • Manually save copies of required web pages from legitimate site.
      • Create new web pages that have the legitimate site's look and feel, but contain completely new content.

  2. Exploit

    They carry out the attack.

    1. [Convince user to enter sensitive information on attacker's site.] An attacker sends an e-mail to the victim that has some sort of a call to action to get the user to click on the link included in the e-mail (which takes the victim to attacker's website) and log in. The key is to get the victim to believe that the e-mail is coming from a legitimate entity with which the victim does business and that the website pointed to by the URL in the e-mail is the legitimate website. A call to action will usually need to sound legitimate and urgent enough to prompt action from the user.

      2 techniques
      • Send the user a message from a spoofed legitimate-looking e-mail address that asks the user to click on the included link.
      • Place phishing link in post to online forum.

    2. [Use stolen credentials to log into legitimate site] Once the attacker captures some sensitive information through phishing (login credentials, credit card information, etc.) the attacker can leverage this information. For instance, the attacker can use the victim's login credentials to log into their bank account and transfer money to an account of their choice.

      1 technique
      • Log in to the legitimate site using another user's supplied credentials

Prerequisites

  • An attacker needs to have a way to initiate contact with the victim. Typically that will happen through e-mail.

  • An attacker needs to correctly guess the entity with which the victim does business and impersonate it. Most of the time phishers just use the most popular banks/services and send out their "hooks" to many potential victims.

  • An attacker needs to have a sufficiently compelling call to action to prompt the user to take action.

  • The replicated website needs to look extremely similar to the original website and the URL used to get to that website needs to look like the real URL of the said business entity.

Skills required

  • Medium skill

    Basic knowledge about websites: obtaining them, designing and implementing them, etc.

Resources required

  • Some web development tools to put up a fake website.

Signs of an attack

  • You receive an e-mail from an entity that you are not even a customer of prompting you to log into your account.

  • You receive any e-mail that provides you with a link which takes you to a website on which you need to enter your log in information.

Consequences

What a successful attack can lead to
ImpactAffectsNote
Gain PrivilegesConfidentiality, Access Control, Authorization
Read DataConfidentiality
Modify DataIntegrity

Mitigations

  • Do not follow any links that you receive within your e-mails and certainly do not input any login credentials on the page that they take you too. Instead, call your Bank, PayPal, eBay, etc., and inquire about the problem. A safe practice would also be to type the URL of your bank in the browser directly and only then log in. Also, never reply to any e-mails that ask you to provide sensitive information of any kind.

Weaknesses it exploits

  • CWE-451 User Interface (UI) Misrepresentation of Critical Information

Recent CVEs with these weaknesses

  1. 4.8CVE-2026-123995

    Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an input validation vulnerability in the UPnP/DLNA AVTransport SOAP service that allows a LAN-adjacent attacker to inject arbitrary URIs via the CurrentURI field of SetAVTransport…

  2. 5.4CVE-2026-121244

    UI misrepresentation in FileAPI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

  3. 5.4CVE-2026-121216

    UI misrepresentation in UI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

  4. 5.4CVE-2026-121215

    UI misrepresentation in Bluetooth in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

  5. 4.3CVE-2026-121209

    UI misrepresentation in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)

  6. 5.4CVE-2026-121206

    UI misrepresentation in Isolated in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

  7. 4.3CVE-2026-121190

    UI misrepresentation in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Low)

  8. 5.4CVE-2026-121186

    UI misrepresentation in Passwords in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

The newest records naming one of them. Each weakness's page lists them all.

Part of
Can lead to
More specific patterns

Examples

The target gets an official looking e-mail from their bank stating that their account has been temporarily lo…

The target gets an official looking e-mail from their bank stating that their account has been temporarily locked due to suspected unauthorized activity and that they need to click on the link included in the e-mail to log in to their bank account in order to unlock it. The link in the e-mail looks very similar to that of their bank and once the link is clicked, the log in page is the exact replica. The target supplies their login credentials after which they are notified that their account has now been unlocked and that everything is fine. An attacker has just collected the target's online banking information which can now be used by the attacker to log into the target's bank account and transfer money to a bank account of the attackers' choice.

An adversary may use BlueJacking, or Bluetooth Phishing to send unsolicited contact cards, messages, or pictu…

An adversary may use BlueJacking, or Bluetooth Phishing to send unsolicited contact cards, messages, or pictures to nearby devices that are listening via Bluetooth. These messages may contain phishing content.

MITRE's words, unchanged: CAPEC-98 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.