Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Email phishing attacks impersonate people, companies, or services to trick recipients into sharing information, sending money, granting account access, or opening malicious files. The most useful way to distinguish them is by their target and goal: a broad credential phish may imitate a familiar service, while spearphishing targets a person, whaling targets a high-profile individual, and business email compromise (BEC) exploits business payment or disclosure workflows. Links, attachments, QR codes, and app-permission prompts are delivery methods that can overlap with those categories.
Which email phishing attacks are most common?
There is no universal ranking that covers every phishing message worldwide. In its report on observed activity in the second quarter of 2026, Microsoft Threat Intelligence detected approximately 7.6 billion email-based phishing threats. Credential phishing accounted for 94–96% of Microsoft’s observed payload-based attacks in each month of that quarter. Those figures describe Microsoft’s measured traffic and its payload-based subset—not the share of all phishing emails everywhere.
That finding helps explain why fake sign-in requests are so familiar, but it does not mean every attack is aimed at passwords. Some seek a payment, sensitive documents, malware execution, or permission to access an account. The joint CISA, NSA, FBI, and MS-ISAC guidance says malicious actors primarily use phishing to obtain login credentials for initial network access (2025 joint phishing guidance).
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Common email phishing types and how they differ
These labels are not mutually exclusive. A targeted email can carry a malicious link, a QR code, or an attachment; a BEC attempt can begin with stolen credentials; and a fake brand sign-in may be sent broadly or tailored to one recipient. Distinguish the attack by asking who is targeted, what the attacker wants, and how the message tries to earn trust.
#1 Best Overall
| Type | Target or trust tactic | Typical goal or lure |
|---|---|---|
| Credential phishing | Often imitates a familiar company or service | Capture a username, password, or other sign-in details through a counterfeit login page |
| Spearphishing | A particular person or group, using relevant details | Steal credentials, deliver malware, or support a larger fraud |
| Whaling | A high-profile person | Obtain sensitive or high-value information |
| Business email compromise (BEC) | Business relationships, payment procedures, or a real or spoofed mailbox | Prompt a fraudulent payment or disclosure of information |
| Malicious-link or attachment phishing | A message uses a link or file as its route to the victim | Send the recipient to a fake site or deliver a malicious payload |
| QR-code phishing | A code in the message or an attachment moves the recipient to a web page | Often direct the person to a credential-harvesting or payment page |
| OAuth consent phishing | A fake or malicious app authorization request may use a legitimate provider | Obtain permission to access account data without collecting the password |
Broad impersonation and credential phishing
A message may appear to come from a bank, utility, online service, or other familiar organization. It can claim that a payment is overdue, an account needs verification, or a problem requires immediate attention. The link leads to a lookalike sign-in page, or the message displays a spoofed login screen that captures credentials. A familiar logo or sender display name does not authenticate the request; assess what it asks you to do and verify through a separate, trusted route.
Spearphishing and whaling
Spearphishing is directed at a particular individual or group and uses information about them to make the request credible. CISA describes it as phishing targeted at an individual using key information about that person. It can seek credentials, deliver malware, or form part of a broader business fraud.
Whaling is spearphishing aimed at a high-profile person, often to obtain sensitive or high-value information. The term describes the target, not a special technical delivery method: the email may look like an ordinary business request.
Recommended Free Tools
Business email compromise and account compromise
BEC exploits trust in business email and payment or information-sharing workflows. FBI examples include a vendor invoice with changed payment details, an executive asking an assistant to buy gift cards, and altered wire instructions in a home purchase. An attacker may spoof an address, use targeted phishing to learn about the organization, or access a real mailbox and its existing invoice conversations. In the last case, the sender address can be genuine even though the request is fraudulent.
Verify any change to payment details using a phone number already known to be legitimate and the organization’s established approval procedure—not contact information supplied in the email. The FBI’s Business Email Compromise guidance describes the scheme and its common forms.
Malicious links and attachments
A link may lead to a counterfeit website; an attachment may deliver a malicious payload. In Microsoft’s Q2 2026 observations, HTML attachments made up 35–41% and PDF attachments 24–31% of payload-based attacks across the quarter. Together, those formats represented roughly 60–70% monthly. These are Microsoft Threat Intelligence figures for its observed payload-based attacks, not the proportion of all email attachments that are harmful. A file type alone does not prove a message is malicious; consider whether the sender and file are expected, and follow your workplace reporting process if anything is suspicious.
QR-code phishing
A QR code embedded in an email or its attachment can take the recipient out of the email client and onto a website, including a credential-harvesting page. Microsoft tracked QR-code phishing in 2026 and reported that PDF attachments were its dominant delivery vehicle in Q2, although their share weakened during the quarter. That does not make every QR code or PDF dangerous. Treat an unexpected code that leads to a login or payment request with the same caution as a suspicious link.
OAuth consent phishing
Instead of asking for a password, an email can lure someone to an app authorization screen and ask them to grant access. In a September 1, 2026 alert, FBI IC3 described malicious actors using a legitimate provider in a consent-phishing flow. If the recipient approves the app, it may access account data such as email without the attacker ever learning the password. That access can remain active after a password change; revoke the app’s permission in the account’s security settings and notify the appropriate security team. See the FBI IC3 alert on consent phishing.
How to spot a suspicious email
Warning signs include an unfamiliar or subtly altered sender address, a generic greeting, an unexpected attachment, a link whose destination does not match the apparent sender, unusual formatting, a request for credentials, or pressure to act urgently. These are clues, not a pass-or-fail test: polished messages can be fraudulent, and typos alone do not prove fraud.
- Pause when a message unexpectedly asks you to sign in, pay, disclose sensitive information, open a file, or grant an app access.
- Do not rely on the sender’s display name, branding, or a familiar-looking email thread as proof that the request is genuine.
- Do not use links or phone numbers in the message to check its claims. Open the organization’s website independently or call a number you already trust.
- For an unexpected colleague or executive request, verify it through a separate channel, especially when it changes payment instructions or requests sensitive information.
The CISA Phishing General Security Postcard and the FBI’s spoofing and phishing guidance offer additional recognition advice.
What to do if you receive or act on a phishing email
If you have not interacted with it
- Do not click its links, open unexpected attachments, scan its QR code, or approve an app request.
- Report it using your email provider’s reporting option or your workplace security process.
- After reporting it, delete the message if your provider or organization does not instruct you to preserve it.
If you entered credentials or approved an app
- If you entered a password, go directly to the legitimate service and change it promptly. Follow your organization’s incident procedures if it is a work account.
- If you granted an app access, revoke its permission in your account’s security settings. A password change alone may not end that access.
- Alert your workplace security team or the relevant service provider so they can assess the account and any further steps needed.
If you sent money or disclosed payment details
Contact your financial institution immediately and ask it to contact the receiving institution. Report the incident through your organization’s established fraud process as well. The FTC’s phishing advice explains how to report suspicious messages and respond to a possible scam.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →How organizations can reduce phishing risk
Organizations need controls for both the email channel and the business decisions an attacker tries to influence. The FTC recommends that businesses use SPF, DKIM, and DMARC so receiving systems can check whether mail claiming to come from their domain is authorized. It also recommends employee training, clear reporting processes, and verification policies for wire requests. CISA recommends phishing-resistant multifactor authentication (MFA) and security reporting processes.
- Use a documented, independently verified procedure for changing vendor bank details or approving unusual payments.
- Make it easy for employees to report suspicious messages and ensure reports reach the people responsible for response.
- Use domain email-authentication controls and phishing-resistant MFA as risk-reduction measures; neither guarantees that every fraudulent message will be blocked or recognized.
See the FTC’s Cybersecurity for Small Business guidance and CISA’s Actions to Help Prevent Being Hooked in a Phishing Attack for further recommendations.
Related phishing threats that are not email types
Smishing uses text messages, and vishing uses voice calls. They are phishing variants rather than email attack categories, though attackers may use them alongside email or as follow-up contact. The same basic verification principle applies: use a trusted contact route independent of the message or caller.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
