Common Cyber Attacks: Phishing, Malware and Social Engineering

Before you can defend a system you need to understand how it gets attacked. The vast majority of real-world breaches do not begin with exotic zero-day exploits; they begin with a convincing email, a poisoned download or a phone call. This lesson surveys the most common attack categories and, crucially, the defenses that stop them.

Phishing

Phishing is the practice of sending fraudulent messages that appear to come from a trusted source, usually to steal credentials or deliver malware. Variants include:

Spear phishing: a message tailored to one person, referencing their real projects or colleagues.
Whaling: spear phishing aimed at executives with high-value access.
Smishing and vishing: the same trick delivered by SMS or voice call.

A typical phishing email creates urgency ('your account will be suspended'), includes a link to a lookalike domain, and asks you to log in. The fake site harvests the password.

Defending against phishing

Check the actual sender domain and hover over links before clicking; paypa1-security.com is not PayPal.
Never enter credentials on a page you reached from an email link; navigate to the site directly instead.
Enable multi-factor authentication everywhere, so a stolen password alone is not enough.
As a developer, implement email authentication (SPF, DKIM, DMARC) on your own domains so attackers cannot easily spoof them.

Malware

Malware is any software written to cause harm. The main families are:

Viruses and worms: code that spreads by attaching to files or by exploiting network services on its own.
Trojans: programs that pretend to be useful, such as a cracked game installer carrying a backdoor.
Ransomware: encrypts your files and demands payment, an availability attack with a business model.
Spyware and keyloggers: silently record activity and credentials.

Defenses are layered: keep operating systems and dependencies patched, download software only from official sources, run reputable endpoint protection, and keep offline backups so ransomware loses its leverage.

Social Engineering

Social engineering attacks the human, not the machine. An attacker may impersonate IT support asking for a password reset, tailgate through a secure door, or leave infected USB drives in a car park. Technology cannot fully fix this; process can. Strong organizations use verification callbacks, never share credentials over the phone, and build a culture where questioning an unusual request is praised rather than punished.

Attacks Developers Enable by Accident

Some common attacks succeed because of small development mistakes:

Credential stuffing: attackers replay passwords leaked from other sites. Defense: MFA and rate limiting on login endpoints.
Brute force: automated password guessing. Defense: account lockouts, delays and CAPTCHA-style challenges after repeated failures.
Man-in-the-middle: intercepting traffic on open networks. Defense: enforce HTTPS everywhere, which a later lesson covers in depth.

Here is a simple defensive pattern, rate limiting a login route so automated guessing becomes impractical:

javascript

// Rate limiting a login endpoint (Express)
const rateLimit = require('express-rate-limit');

const loginLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 5,                    // 5 attempts per window per IP
  message: { error: 'Too many attempts. Try again later.' },
  standardHeaders: true,
});

app.post('/login', loginLimiter, handleLogin);

Five attempts per quarter hour is generous for a human and hopeless for a bot trying millions of passwords.

Recognizing an Attack in Progress

Warning signs include unexpected password-reset emails, MFA prompts you did not trigger, unusual outbound traffic from a server, and logins from unfamiliar locations. Logging and alerting on these signals turns a silent breach into a contained incident, a topic we return to in the final lesson of this course.

Key Takeaways

Most breaches start with phishing or social engineering, not sophisticated exploits.
Verify senders, avoid credential entry via email links, and use MFA as a safety net.
Malware defense combines patching, trusted sources and offline backups.
Rate limiting and lockouts blunt credential stuffing and brute force attacks.
Humans are part of the attack surface; train and design processes accordingly.

Next lesson: Passwords, Hashing and Multi-Factor Authentication, where we learn how to store and verify credentials safely.