What is Phishing?
Phishing is a social engineering attack in which an adversary sends fraudulent communications — typically email, SMS, or instant messages — that impersonate a trusted entity to trick recipients into revealing sensitive information, clicking malicious links, or installing malware.
Also known as: spear phishing, credential phishing
Phishing remains the most common initial attack vector in data breaches. Basic phishing campaigns cast a wide net with generic messages, while spear phishing targets specific individuals using personal or organizational details to increase credibility. Credential phishing specifically aims to harvest usernames and passwords by directing victims to convincing replicas of legitimate login pages.
The effectiveness of phishing stems from exploiting human psychology rather than technical vulnerabilities. Attackers create urgency ("your account will be locked"), authority ("message from your CEO"), or curiosity ("see the attached invoice") to bypass rational evaluation. Even security-aware users can be caught by well-crafted campaigns, especially when combined with compromised email accounts or lookalike domains.
Defenses are layered: email filtering and link scanning catch bulk campaigns, multi-factor authentication limits the damage from stolen credentials, and security awareness training helps users identify suspicious messages. For sensitive data sharing, eliminating persistent credentials from communication channels — by using ephemeral, self-destructing links instead of pasting secrets into emails — significantly reduces what an attacker can harvest from a compromised inbox.
How Vaulted uses Phishing
Vaulted reduces phishing risk by keeping sensitive data out of email and chat messages entirely. Instead of pasting a password or API key into a message that could be harvested from a compromised inbox, users share a Vaulted link that self-destructs after a set number of views. Even if a phishing attacker gains access to someone's email, expired Vaulted links yield nothing — the secrets are already gone from the server. Combined with optional passphrase protection, this ensures that intercepted links alone are insufficient to access the shared secret.