Don’t take the bait: Recognize and avoid phishing attacks – ITSAP.00.101 – Canadian Centre for Cyber Security

Summary

This guidance from the Canadian Centre for Cyber Security explains what phishing is, the many forms it takes, and practical steps organisations and employees can use to spot and mitigate attacks. It covers common techniques (deceptive phishing, spear phishing, whaling), newer vectors (quishing, angler phishing), and how AI is changing both the threat and the defence landscape.

The document breaks the attack into three stages—bait, hook, attack—so readers can recognise each phase and act to prevent compromise. It also lists concrete technical controls and user behaviours that reduce risk, from DMARC and MFA to backups, patching and staff training.

Key Points

Phishing is social engineering aimed at stealing credentials, personal data or money by impersonating trusted sources.
Common and emerging types include deceptive phishing, spear phishing, whaling, quishing (QR-based), smishing (SMS), vishing (voice), angler phishing (social media), catfishing and pharming.
AI increases attackers’ ability to craft realistic, personalised messages and synthetic audio, but AI also improves detection and response through behavioural analysis and intrusion detection.
Phishing attacks typically follow a three-step flow: bait (setup), hook (entice action) and attack (credential theft, malware, lateral movement).
Practical defences: implement DMARC-aligned email protection, use MFA, keep systems patched, block known-malicious domains/IPs, maintain backups and update incident response plans.
Human defences are critical: train staff, run phishing simulations, reduce oversharing online and verify requests through separate channels.

How to identify a phishing attack

Look for psychological triggers (urgency, authority, curiosity) and technical red flags. Signs something is phishy include urgent demands, requests for confidential information, unsolicited attachments or links, unfamiliar senders, suspicious URLs (homograph attacks, typo-squatting, misleading subdomains) and unexpected QR codes. AI may mask poor spelling or robotic tone, so focus on verification and context rather than style alone.

Context and relevance

Phishing remains one of the top initial access methods for cyber incidents across public and private sectors and against critical infrastructure. As generative AI gets better, attacks become more convincing and more scalable, raising the importance of layered defences that combine technology (email protection, DMARC, spam filters, MFA) with trained, alert staff and rehearsed incident response procedures. This guidance is timely for any organisation wanting to strengthen basic cyber hygiene and reduce the likelihood of credential theft, fraud or ransomware.

Why should I read this?

Short version: scams are getting clever and fast. This guidance is a no-nonsense primer that tells you what the common tricks look like, why AI makes them trickier, and exactly what to do (and who to train) so you don’t become the next headline. Read it if you manage systems, look after staff, or just want fewer sleepless nights wondering if that email was real.

Source

Source: https://cyber.gc.ca/en/guidance/dont-take-bait-recognize-and-avoid-phishing-attacks