The classic form of phishing is the dominant attack vector, consisting of mass distribution of fake messages, most often via email, but also SMS (smishing) or instant messengers. This attack is characterized by mass distribution to a huge number of recipients without detailed selection and weak or zero personalization of messages, which typically contain generic phrases such as „Dear Customer“. The key technique is impersonating trusted and widely known brands, such as banks, courier companies, or government institutions, by mimicking their visual identity and logo, which is intended to legitimize the fake communication (Brand Impersonation).

Scammers use social engineering techniques, putting pressure on the recipient through a sense of urgency (e.g., information about a blocked account), the threat of losing benefits, or arousing curiosity. The main goal of the attack is to trick the victim into providing confidential data (logins, passwords, card numbers) on a fake website, deceptively resembling the real one (website spoofing), downloading malicious software (Malware) hidden in an attachment, or making a transfer through a fake payment gateway. Despite its simplicity and lack of personalization, classic phishing is still effective, exploiting people’s inattention, haste, and trust in recognizable brands.