Phishing
Deceptive messages lure people into sharing information, opening harmful files or visiting fake websites.
Reduce the risk: Open the service directly and verify unexpected requests.
30 cyberattack types explained
Recognise the threat. Understand the risk. Know your next step.
These examples cover attack techniques, malware types and common variants. They can overlap: one incident may start with phishing and lead to account theft or ransomware. This is an awareness guide, not a ranking or a complete list.
Showing all 30 attack types
Messages & impersonation
Further reading: NCSC phishing guidance.
Spear phishing
Phishing tailored to a particular person or organisation using details that make it convincing.
Reduce the risk: Confirm sensitive requests using a known contact method.
Whaling
Targeted phishing aimed at senior leaders or other high-value decision makers.
Reduce the risk: Require independent approval for sensitive payments and data releases.
Smishing
Phishing delivered through text messages, often impersonating delivery companies or banks.
Reduce the risk: Avoid unexpected message links; use the official app.
Vishing
Voice calls trick people into revealing credentials, sending money or granting remote access.
Reduce the risk: Hang up and call back using an independently verified number.
Business email compromise
An impersonated or compromised business mailbox is used to divert payments or obtain information.
Reduce the risk: Confirm bank-detail changes outside the email conversation.
Accounts & sign-ins
Further reading: NCSC account-security guidance.
Brute-force guessing
Repeated password guesses try to unlock an account.
Reduce the risk: Use long unique passwords, multi-factor authentication (MFA), and login rate limits.
Password spraying
A few common passwords are tried against many accounts.
Reduce the risk: Block common passwords and monitor failed sign-ins across accounts.
Credential stuffing
Passwords stolen from one service are reused to try other accounts.
Reduce the risk: Use a different password for every service and enable MFA.
MFA fatigue
Repeated approval prompts pressure a user into accepting an attacker’s login.
Reduce the risk: Reject unexpected prompts and prefer phishing-resistant passkeys or security keys.
Session hijacking
A stolen session token lets an attacker act as an already signed-in user.
Reduce the risk: Protect devices, keep software updated and revoke sessions after compromise.
Adversary-in-the-middle phishing
A fake sign-in service relays a real login and may steal the resulting session.
Reduce the risk: Use phishing-resistant authentication and trusted bookmarks for important services.
Malware & harmful software
Further reading: CISA malware guidance.
Ransomware
Malware locks files or systems; attackers may also steal data and demand payment.
Reduce the risk: Maintain isolated, tested backups and patch exposed services.
Trojan malware
Software appears useful or legitimate but secretly performs harmful actions.
Reduce the risk: Install software only from trusted sources and restrict installation rights.
Spyware
Malware secretly monitors activity or collects private information.
Reduce the risk: Review app permissions and use maintained endpoint protection.
Keylogging
Software or hardware records keystrokes, potentially capturing passwords and messages.
Reduce the risk: Protect devices from tampering and investigate unexpected software.
Worms
Malware spreads between systems without needing users to copy it manually.
Reduce the risk: Patch vulnerabilities and separate networks to limit spread.
Botnet infection
A compromised device joins a remotely controlled network used for spam, disruption or other abuse.
Reduce the risk: Update devices, replace default passwords and investigate unusual outbound traffic.
Networks & disruption
Further reading: NCSC common cyberattacks overview.
Man-in-the-middle attack
An attacker positions themselves between communicating parties to intercept or alter inadequately protected traffic.
Reduce the risk: Use HTTPS, respect certificate warnings and secure network access.
Evil twin Wi-Fi
A rogue hotspot impersonates a legitimate wireless network to lure users.
Reduce the risk: Confirm the network name; use mobile data when uncertain and never bypass certificate warnings.
DNS poisoning or hijacking
Tampered name-resolution information sends people to an unintended destination.
Reduce the risk: Protect DNS and registrar accounts; investigate unexpected website or certificate changes.
Denial of service (DoS)
An attack exhausts resources or triggers failures that make a service unavailable.
Reduce the risk: Plan incident response and coordinate protection with the hosting provider.
Distributed denial of service (DDoS)
Many sources jointly overwhelm a service.
Reduce the risk: Use provider-level traffic filtering and DDoS protection suited to the service.
Software supply-chain attack
A compromised supplier, dependency or update delivers harm through a trusted relationship.
Reduce the risk: Track dependencies, verify updates and limit supplier access.
Websites & applications
Further reading: OWASP application-security overview.
SQL injection
Untrusted input changes a database query.
Reduce the risk: Use parameterised queries and restricted database permissions.
Cross-site scripting (XSS)
Injected scripts run in another visitor’s browser.
Reduce the risk: Encode output correctly and use safe rendering APIs.
Cross-site request forgery (CSRF)
A signed-in browser is tricked into performing an unwanted action.
Reduce the risk: Use anti-CSRF protections and appropriate cookie settings.
Broken access control / IDOR
Missing permission checks expose another user’s records or actions.
Reduce the risk: Enforce server-side authorisation on every protected request.
Command injection
Untrusted input alters commands executed by a server.
Reduce the risk: Avoid shell execution with user input; use constrained APIs.
Server-side request forgery (SSRF)
An application is tricked into requesting an unintended destination.
Reduce the risk: Restrict outbound destinations and protect internal services.
No matches. Try a broader term, such as “password”, or clear your search.