Skip to content

Phishing Attack

Someone in your organization clicked a malicious link, opened a dangerous attachment, or entered credentials on a fake website. Phishing is often the first step in a larger attack.

Types of Phishing

  • Email phishing - Mass emails with malicious links/attachments
  • Spear phishing - Targeted emails personalized to the victim
  • Whaling - Targeting executives specifically
  • Smishing - Phishing via SMS/text messages
  • Vishing - Phishing via voice calls
  • QR code phishing - Malicious QR codes leading to fake sites

Immediate Actions

If Credentials Were Entered

  1. Change password immediately - On the compromised account AND any accounts using the same password
  2. Enable/reset 2FA - Remove old 2FA, set up new one
  3. Check account activity - Login history, sent messages, forwarding rules
  4. Revoke sessions - Force logout from all devices
  5. Alert IT/security - Others may have received the same phishing email
  1. Disconnect from network - If malware might have been downloaded
  2. Don't enter any information - Close the browser
  3. Scan the device - Run antivirus scan
  4. Clear browser cache - Remove any cached malicious content
  5. Report the email - Forward to IT/security team

If Attachment Was Opened

  1. Disconnect from network immediately
  2. Do NOT turn off the computer - Evidence in memory
  3. Assume malware infection - See Malware Infection guide
  4. Alert IT/security

Report Phishing

Report to Email Provider

  • Gmail: Click three dots → "Report phishing"
  • Outlook: Select email → "Report message" → "Phishing"
  • Apple Mail: Forward to reportphishing@apple.com

Report to Authorities

Report Phishing URLs

Analyze Suspicious Emails

Check URLs Before Clicking

Analyze Email Headers

Full headers reveal the true sender: - MXToolbox Header Analyzer: mxtoolbox.com/EmailHeaders.aspx - Google Admin Toolbox: toolbox.googleapps.com/apps/messageheader

Analyze Attachments (Safely)

  • VirusTotal: Upload file for scanning (⚠️ files become public)
  • Hybrid Analysis: hybrid-analysis.com - Sandbox analysis
  • Any.Run: any.run - Interactive analysis

Evidence to Preserve

  • [ ] Original phishing email (with full headers)
  • [ ] Screenshot of fake login page (if applicable)
  • [ ] URL of phishing site
  • [ ] Any files that were downloaded
  • [ ] Timestamp of when link was clicked
  • [ ] Logs showing account access after compromise

Prevention: Technical Controls

Email Security

  • DMARC, DKIM, SPF - Prevent email spoofing
  • External email banners - Warn users of external emails
  • URL rewriting - Scan links at click time
  • Attachment sandboxing - Analyze attachments before delivery

User Training

  • Simulated phishing tests - Regular exercises
  • Clear reporting process - Make it easy to report suspicious emails
  • No punishment for reporting - Encourage a security culture

Technical Protections

  • Multi-factor authentication - Limits damage from stolen credentials
  • Password managers - Won't autofill on fake domains
  • Web filtering - Block known phishing domains

Guides & Documentation

CISA Phishing Guidance

KnowBe4 Phishing Resources

EFF Phishing Guide

Security in a Box - Phishing

Need Help?

If your Swedish organization has been targeted by a sophisticated phishing campaign:

Apply to HackAid - We can help investigate the extent of compromise.

Last updated: 2026-01