The phishing family taken apart — spear phishing and whaling, QR-code quishing, SMS smishing. How to recognise each one and what to ask of your team.
One word covers a dozen different techniques. Each uses a different channel and a different psychological lever. We go through them one by one and show what gives each of them away.
A mass campaign counts on a fraction of a percent of clicks. Spear phishing needs one. We explain where attackers get their knowledge of your company, and why a payment procedure protects you better than vigilance.
An email filter can inspect every link in a message. It cannot inspect a QR code, because it sees an image. That single gap carries the whole vector, whose detections climbed from 7.6 million in January 2026 to 18.7 million in March.
CERT Polska blocked close to 1.9 million malicious text messages in 2025. That figure only covers messages travelling through the operator network. We explain why this channel works so well, which scenarios keep repeating, what the blocking misses, and where to report a suspicious message.