Phishing

What is phishing?

Phishing is a form of social engineering in which an attacker poses as a trusted party via email, text message, phone or a fake website to get people to hand over login credentials, payment details or other sensitive information, or to make them carry out a harmful action. That action can be opening an attachment containing malware, approving a login request or transferring money to a fraudulent bank account. Phishing has been one of the most common ways into an organisation for decades, including in attacks that eventually reach the OT environment. The consequences range from data breaches and identity theft to financial loss, reputational damage and halted production.

The aim of phishing is almost always a foot in the door: unauthorised access to accounts or systems, or infecting a workstation with malware such as ransomware or spyware.

🧠 How does a phishing attack work?

A phishing attack usually follows the same pattern, whatever the channel:

1. Reconnaissance - the attacker gathers names, job titles, suppliers and email formats from public sources such as LinkedIn, job adverts and press releases.
2. The lure - a message that looks urgent, familiar or attractive: an invoice from a known supplier, a notice from the IT department, a shared document or a parcel delivery.
3. The action - the victim clicks a link to a fake login page, opens an attachment, scans a QR code or calls a number provided in the message.
4. The payoff - the attacker obtains a password, a session cookie or a running backdoor on the workstation, and uses it for the next steps in the cyber kill chain.

The word phishing is a play on fishing (fishing for data), spelled after the older term phreaking. The technique was first documented in the mid-1990s on AOL, where attackers posed as staff to coax passwords out of users.

The MITRE ATT&CK knowledge base lists phishing as technique T1566 under Initial Access, with four sub-techniques: attachment, link, via a service (such as social media or chat) and voice. MITRE ATT&CK for ICS has its own technique for industrial environments: T0865 Spearphishing Attachment.

🔄 What types of phishing are there?

The last type is a variant of a man-in-the-middle attack and explains why not every form of MFA protects against phishing. Generative AI also makes phishing flawless, convincing and cheap to personalise, so spelling mistakes are becoming a less reliable warning sign.

🏭 Why is phishing a risk for OT?

OT systems rarely receive email themselves, but the people and workstations around them do. A successful phishing attack on the office network is therefore often the first step towards process control, especially where IT and OT are connected through OT convergence.

The worst consequences are not always in the control system itself. If ransomware delivered through a phishing email encrypts the planning system, Active Directory or the MES, production stops just the same. Verizon’s annual Data Breach Investigations Report shows a consistent picture: in its 2025 edition, abuse of stolen credentials was the most common starting point of a breach at 22%, and phishing is a major source of those credentials.

Particularly exposed groups in a production environment are:

• Engineers and administrators - their accounts give access to the engineering station, the jump server and remote access
• Purchasing and finance - targets of BEC and fake supplier invoices
• Suppliers and integrators - a compromised mailbox of a trusted party makes an ideal lure; see supplier security

🚨 How do you recognise a phishing attempt?

🔐 How do you protect against phishing?

No single measure stops all phishing. Effective protection combines technology, process and behaviour in layers:

• Email authentication - publish SPF, DKIM and DMARC for all your domains. DMARC is on the Dutch Standardisation Forum’s ‘comply or explain’ list, so Dutch government bodies are in principle required to apply it, even to domains that send no mail.
• Email filtering and URL filtering - block known phishing sites, detonate attachments in a sandbox and tag external senders
• DNS monitoring - detect connections to newly registered or suspicious domains
• Phishing-resistant MFA (multi-factor authentication) - FIDO2/WebAuthn (passkeys, security keys) or PKI smart cards, because SMS codes and push notifications can be relayed through a fake site
• EDR on workstations - detects and stops malware that does get opened
• Least privilege and PAM - never use administrator accounts for email and web browsing, so a stolen ordinary account gives little access
• Network segmentation - no email or internet on systems in the process network, so an infected office workstation cannot reach the control system directly
• Security awareness and reporting - short training sessions, realistic phishing simulations and a report button in the mail client; reward reporting instead of punishing clicks
• Process controls against BEC - always verify bank account changes by phone using a known number, with a second pair of eyes on large payments

🛠️ How do you tackle phishing in an industrial organisation?

A practical five-step approach that fits IEC 62443-2-1 and ISO 27001:

1. Map your exposure - who has email and internet access, and which of those accounts also have access to OT, the VPN or remote access?
2. Separate roles - separate accounts for office work and OT administration; no mail client on HMIs, engineering stations or servers in the process network
3. Strengthen sign-in - phishing-resistant MFA first on remote access, administrator accounts and vendor cloud portals
4. Practise and measure - measure not only the click rate but above all how many staff report suspicious messages, and how quickly
5. Define the follow-up - a playbook in the incident response plan: reset the password, revoke sessions, check the mailbox for forwarding rules and investigate the workstation

In the Netherlands, members of the public can report fake emails to the Fraudehelpdesk; employees report suspicious messages to their own SOC or CSIRT. For organisations within scope of the Cybersecurity Act (in force since 15 August 2026), the Dutch implementation of NIS2, cyber hygiene, training and MFA are explicit duty-of-care measures. If phishing leads to a significant incident, the reporting obligation applies, starting with an early warning within 24 hours.

❓ Frequently asked questions

What is the difference between phishing and spear phishing?

Phishing is the umbrella term for deceptive messages that lure people into a harmful action, often sent in large volumes. Spear phishing is a targeted variant aimed at one person or a small group, with details that make the message credible. In attacks on industrial organisations, spear phishing is the usual form.

Does MFA protect against phishing?

MFA makes a stolen password far less valuable, but not every form of MFA stops phishing. SMS codes, authenticator app codes and push notifications can be captured through an adversary-in-the-middle fake site. Only phishing-resistant MFA, such as FIDO2 security keys, passkeys and PKI smart cards, is bound to the genuine domain and therefore cannot be relayed.

What should you do if you clicked a phishing link?

Report it immediately to your organisation’s IT department, SOC or CSIRT, and change your password if you entered it. Reporting quickly gives administrators the chance to revoke sessions, check the workstation and warn other recipients. With phishing, embarrassment or delay often does more damage than the click itself.

Can phishing shut down an OT environment?

Phishing can shut down an OT environment when the attacker moves from an office workstation into process control or into systems that production depends on. The attack on a German steel mill in 2014 and the Ukrainian blackout in 2015 both started with spear phishing. Segmentation, separate administrator accounts and no email in the process network greatly reduce that risk.

How do you recognise phishing when spelling mistakes disappear?

With generative AI, phishing messages are often flawless, so language is no longer a reliable signal. Look at the context instead: an unexpected request, time pressure, an unusual link or sender, a changed bank account or an MFA prompt you did not trigger yourself. When in doubt, verify the request through a channel you choose yourself, such as a known phone number.

Is a phishing email a reportable incident under NIS2?

A phishing email that is merely received is not a reportable incident under NIS2 or the Dutch Cybersecurity Act. The reporting obligation applies to significant incidents, for example when phishing leads to a compromised account, a data breach or disruption of services. If personal data is involved, the breach notification duty under the GDPR (AVG) may also apply.

📌 In summary

Phishing is a deceptive attack method that uses email, text messages, phone calls or fake websites to trick people into handing over data or carrying out a harmful action. It is often the first step in larger cyber incidents, including in OT; protection requires layers of email authentication, phishing-resistant MFA, segmentation and staff who report suspicious messages quickly.