Phishing, smishing, quishing and impersonation: Security+ guide
Social engineering tricks a person into doing something for the attacker, such as entering a password or running a file. Security+ questions name the attack by its delivery channel: email is phishing, SMS is smishing, a QR code is quishing, a phone call is vishing, and posing as a trusted person or company is impersonation.
Phishing and spearphishing
MITRE ATT&CK defines phishing as sending messages to gain access to victim systems, and says all forms of phishing are electronically delivered social engineering. NIST SP 800-83 describes the classic form: an email or website made to look like a well-known organization so that users disclose personal data such as banking passwords.
Phishing can be targeted. ATT&CK calls this spearphishing: a specific person, company or industry is chosen. Mass spam campaigns are non-targeted phishing. ATT&CK splits spearphishing by delivery: an attachment, a link, a third-party service, and voice.
Smishing, quishing and voice
ATT&CK's mobile phishing technique (T1660) names SMS phishing smishing. The messages try to get the target to install malware, visit a website, or turn on insecure settings on the device.
The same technique names QR-code phishing quishing. A QR code can arrive by SMS or email, or replace a real code in a public place. ATT&CK notes that a QR code sent by email moves the victim from the desktop computer to the mobile device.
Some phishing messages tell the victim to call a phone number. ATT&CK notes the caller may then be talked into installing remote management tools that the attacker can use. ATT&CK lists this as Spearphishing Voice; Security+ uses the name vishing.
Impersonation
ATT&CK technique T1684.001 describes adversaries impersonating a trusted person or organization to persuade a target to act on their behalf. An attacker who registers a domain close to a real audit firm's and asks payroll for salary files is impersonating. The channel can be email, phone or in person; what defines it is the borrowed identity.
Where the exam catches people
Believing quishing is just phishing: Security+ names it separately because the QR code moves the victim from the desktop to a phone.
Believing smishing only steals passwords: ATT&CK says SMS lures also push users to install malware or turn on insecure device settings.
Believing spearphishing always arrives at the work inbox: ATT&CK lists spearphishing via a third-party service as its own sub-technique.
Believing impersonation needs a forged email address: it is defined by posing as a trusted person or organization, through any channel.