CompTIA Exam Prep - ITF+, A+, Network+, Security+, CySA+

Vishing — voice phishing — is social engineering conducted over the phone. An attacker calls, establishes a plausible identity, manufactures urgency, and talks the victim into handing over credentials, approving an MFA prompt, or making a payment. A phishing email gives the target time to think. A phone call does not, and that is the entire point. Email phishing can be reread, forwarded to IT, and checked against the sender's real address. A live call moves at the attacker's pace, exploits politeness, and leaves no artifact to examine. That is why vishing succeeds against people who would never click a suspicious link — and why it has become the preferred route past MFA. The Techniques Caller ID spoofing. Trivially easy, and it underpins nearly every campaign. The display can read your bank's real number, your own company's help desk, or a government agency. Caller ID is not authentication and never was — worth saying plainly, because most people treat it as ...

Obfuscated links are URLs deliberately disguised so the recipient cannot tell where they actually lead. They are a core phishing technique, and they work because people have been trained to "check the link before clicking" without being taught what part of a link actually matters. Everything in a URL before the final domain can be faked. The only part that decides where you go is the registrable domain immediately left of the first single slash. How Links Get Disguised Mismatched display text. In HTML email, the visible text and the destination are separate. A link reading www.yourbank.com can point anywhere at all. This is the simplest technique and still the most effective. Subdomain deception. yourbank.com.secure-login.ru is a subdomain of secure-login.ru , not of yourbank.com. Readers scanning left to right see the familiar name first and stop reading. Read a domain from the right, not the left. Typosquatting and homoglyphs. arnazon.com with rn in place...