November 5, 2026
Updated: November 5, 2026
Phishing to prompt injection: 20 attack types, how often they appear in Verizon's DBIR, how they chain together and the controls and tests that stop them.
Mohammed Khalil
The main types of cyber attacks fall into five families: social engineering and identity attacks (phishing, business email compromise, password attacks), malware (including ransomware), network attacks (DDoS, man-in-the-middle, DNS spoofing), web application attacks (SQL injection, XSS, CSRF, SSRF, IDOR, buffer overflows) and systemic attacks (zero-days, supply chain compromises, insider threats and AI-driven attacks). Verizon's 2026 Data Breach Investigations Report found that vulnerability exploitation (31%), phishing (16%) and credential abuse (13%) were the leading ways into breached organizations. This guide explains 20 attack types and maps each one to MITRE ATT&CK.
NIST's glossary defines a cyber attack as an attack via cyberspace that targets an organization's use of cyberspace to disrupt, disable, destroy or maliciously control a computing environment, to destroy the integrity of data, or to steal controlled information. In plain terms, someone deliberately tries to break the confidentiality, integrity or availability of your systems or data.
Three terms are often mixed up:
Attack types are useful labels, but they overlap. A single breach can start with phishing, continue with credential theft and end with ransomware. That is why defenders also use MITRE ATT&CK, a public knowledge base that describes attacker behavior as tactics (the goal of a step, such as Initial Access or Impact) and techniques (how the step is done, such as T1566 Phishing). ATT&CK Enterprise v20 lists 15 tactics. Mapping each attack type to its tactic tells you where in an intrusion it usually happens and which detections should catch it. Our MITRE ATT&CK framework guide explains the matrix in depth, and the cyber kill chain gives the older, seven-stage view of the same idea.
| # | Attack type | Family | Main ATT&CK tactic | Example technique |
|---|---|---|---|---|
| 1 | Phishing and spear phishing | Social engineering | Initial Access | T1566 Phishing |
| 2 | Vishing, smishing and pretexting | Social engineering | Initial Access, Reconnaissance | T1566.004 Spearphishing Voice; T1598 |
| 3 | Business email compromise (BEC) | Social engineering | Impact | T1657 Financial Theft |
| 4 | Password attacks | Identity | Credential Access | T1110 Brute Force |
| 5 | Credential theft and pass-the-hash | Identity | Credential Access, Lateral Movement | T1003; T1550.002 |
| 6 | Malware, including fileless malware | Malware | Execution | T1204 User Execution; T1059 |
| 7 | Ransomware | Malware | Impact | T1486 Data Encrypted for Impact |
| 8 | Denial of service and DDoS | Network | Impact | T1498; T1499 |
| 9 | Man-in-the-middle | Network | Credential Access, Collection | T1557 Adversary-in-the-Middle |
| 10 | DNS spoofing and DNS tunneling | Network | Credential Access, Command and Control | T1557; T1071.004 |
| 11 | SQL injection | Web application | Initial Access | T1190 Exploit Public-Facing Application |
| 12 | Cross-site scripting (XSS) | Web application | Initial Access, Credential Access | T1189; T1539 |
| 13 | Cross-site request forgery (CSRF) | Web application | No dedicated technique | CAPEC-62; CWE-352 |
| 14 | Server-side request forgery (SSRF) | Web application | Initial Access, Credential Access | T1190; T1552.005 |
| 15 | IDOR and broken access control | Web application | Initial Access | T1190; CWE-639 |
| 16 | Buffer overflow | Software exploitation | Initial Access, Execution | T1190; T1203 |
| 17 | Zero-day exploits | Software exploitation | Initial Access, Privilege Escalation | T1190; T1068 |
| 18 | Supply chain attacks | Systemic | Initial Access | T1195 Supply Chain Compromise |
| 19 | Insider threats | Systemic | Initial Access, Exfiltration | T1078 Valid Accounts |
| 20 | AI-powered attacks | Systemic | Initial Access (ATLAS for AI systems) | AML.T0051; AML.T0088 |
Technique IDs and tactic names come from MITRE ATT&CK Enterprise v20. CSRF has no dedicated ATT&CK technique, so the table uses MITRE's CAPEC-62 attack pattern. AI-specific techniques come from MITRE ATLAS, ATT&CK's companion knowledge base for attacks on AI systems.
Frequency matters more than novelty when you decide what to defend first. The Verizon 2026 Data Breach Investigations Report analyzed more than 31,000 security incidents and 22,624 confirmed data breaches across 145 countries, covering November 1, 2024 to October 31, 2025. Its headline numbers map directly onto the attack types in this guide:
Treat these figures as a strong sample of reported breaches rather than a census of every attack. Verizon's data comes from almost a hundred contributors, so the mix shifts as contributors change.
These attacks target people and identities rather than code. They remain popular because a convincing message or a reused password is cheaper than an exploit.
Phishing is a fraudulent message, usually email, that tricks the recipient into clicking a malicious link, opening a malicious attachment or entering credentials on a fake page. ATT&CK tracks it as T1566 Phishing under Initial Access, with sub-techniques for attachments, links, third-party services and voice. Spear phishing is the targeted version: the attacker researches one person or team and tailors the lure, and whaling aims the same approach at executives. Phishing was the initial access vector in 16% of breaches in the 2026 DBIR, the same share as the year before, and many credential abuse cases start with a phished password. For trend data see our phishing statistics, and for QR-code lures our guide to quishing. Our spear phishing guide covers targeted lures, whaling and BEC in depth.
Vishing (voice phishing) and smishing (SMS phishing) move the same deception to phone calls and text messages, where people are less suspicious and security tools see less. Pretexting is the invented story behind the request, such as an IT help desk call asking you to approve an MFA prompt. ATT&CK added Spearphishing Voice (T1566.004) for call-based lures and tracks information-gathering lures as Phishing for Information (T1598) under Reconnaissance. Verizon's 2026 DBIR found that the median click rate in phone-centric phishing simulations was about 40% higher than for email, and that pretexting rose to 6% of breach entry points. Our explainer on what social engineering is covers the psychology, and the vishing statistics and smishing statistics posts track the volumes.
Business email compromise is a fraud in which an attacker impersonates or takes over a trusted email account, such as a CEO, supplier or lawyer, and asks for a payment or sensitive data. There is often no malware at all, which is why BEC bypasses many technical controls. ATT&CK maps the end goal to Financial Theft (T1657) under Impact, and v20 tracks the impersonation step as Social Engineering: Impersonation (T1684.001). The 2026 DBIR records the trust-building conversations behind such scams as pretexting, which it found runs over voice calls as well as email and text messages. Verifying every payment change through a known phone number is the most effective single control. See our business email compromise statistics for more.
Password attacks try to log in as a real user without stealing anything first. ATT&CK groups them under Brute Force (T1110) in the Credential Access tactic:
In the 2026 DBIR's Basic Web Application Attacks pattern (3,217 incidents), the use of stolen credentials is still the defining action. Phishing-resistant MFA, lockout and rate limits, and checks against known-breached passwords blunt all three. Read more in our credential stuffing statistics and password statistics.
Credential theft collects passwords, hashes, tokens and session cookies that already exist on a system, for example by dumping them from memory (OS Credential Dumping, T1003) or harvesting them with infostealer malware. Pass-the-hash then reuses a captured NTLM hash to authenticate without ever knowing the plaintext password, which ATT&CK lists as Pass the Hash (T1550.002) under Lateral Movement. The 2026 DBIR found that among ransomware victims with a prior credential leak or infostealer event, half had that event within 95 days before the attack. A dated example: in its June 10, 2024 report on UNC5537, Mandiant traced every Snowflake customer incident it responded to back to compromised customer credentials, and the first victim's account had been accessed with infostealer-stolen credentials and had no MFA enabled. Our guides to pass-the-hash attacks and infostealer malware go deeper.
Malware is software written to harm, spy on or take control of a system. It is a delivery mechanism as much as an attack type, and it shows up at almost every stage of an intrusion.
Viruses attach to legitimate files, worms spread on their own across networks, trojans pose as useful software, and infostealers quietly collect saved passwords, cookies and crypto wallets. Most still need a user or a process to run them, which ATT&CK tracks as User Execution (T1204) under the Execution tactic. Fileless malware avoids writing a traditional executable to disk and instead abuses built-in tools such as PowerShell, which maps to Command and Scripting Interpreter (T1059). Endpoint detection and response (EDR), application allowlisting and script logging catch far more of it than signature antivirus alone. See our explainer on fileless malware and the malware statistics roundup. Our guide to the types of malware explains all 16 kinds with dated examples.
Ransomware encrypts or steals an organization's data and demands payment to restore access or to keep the data off a leak site. ATT&CK maps the encryption step to Data Encrypted for Impact (T1486) and the deletion of backups and shadow copies to Inhibit System Recovery (T1490), both under Impact. Ransomware is the end of a chain, not the start: operators usually get in through stolen credentials, phishing or an exploited edge device first. The 2026 DBIR found ransomware in 48% of breaches, up from 44%. Where the victim's size was known, about 96% of ransomware victims were small and medium-sized businesses, most often compromised through stolen credentials (38%) or unpatched edge devices (29%). A well-documented example is the MOVEit Transfer campaign: CISA and the FBI reported that the CL0P gang began exploiting a SQL injection zero-day in May 2023 to steal data at scale. Our ransomware statistics cover current numbers.
Network attacks target the plumbing: availability of services, the traffic between systems, and the name resolution everything depends on.
A denial-of-service (DoS) attack makes a service unavailable by overwhelming it with traffic or requests, or by triggering a resource-exhausting bug. A distributed denial-of-service (DDoS) attack sends that load from many machines at once, usually a botnet. ATT&CK separates Network Denial of Service (T1498) from Endpoint Denial of Service (T1499), both under Impact. The 2026 DBIR counted 5,514 DoS incidents. The median attack size has stayed between 4.2 and 6 Gbps in recent years and half of attacks lasted under nine minutes, but the largest attacks grew 198% in bits per second over the previous year. The HTTP/2 Rapid Reset technique (CVE-2023-44487) shows how a protocol flaw changes the math: Cloudflare reported a peak just above 201 million requests per second in 2023, generated by a botnet of about 20,000 machines. For how DDoS attacks work and how to defend against them, see our guide to what a DDoS attack is; for trend data, see our DDoS attack statistics.
In a man-in-the-middle (MITM) attack, the attacker positions themselves between two parties so traffic flows through them, letting them read, modify or replay it. ATT&CK calls this Adversary-in-the-Middle (T1557), under both Credential Access and Collection. On local networks the classic method is ARP cache poisoning (T1557.002), explained in our guide to ARP spoofing. On the internet, modern phishing kits act as reverse proxies that relay a real login page and capture the session cookie after MFA succeeds. TLS everywhere, HSTS, phishing-resistant MFA and network segmentation are the main defenses. Our man-in-the-middle attack guide walks through each technique and its defenses.
DNS is abused in two opposite directions. DNS spoofing (or cache poisoning) feeds a resolver or a victim false answers so that a legitimate name points to an attacker's server, which is a form of adversary-in-the-middle. DNS tunneling hides data or command-and-control traffic inside DNS queries, which ATT&CK tracks as Application Layer Protocol: DNS (T1071.004) under Command and Control, because DNS is rarely blocked outbound. DNSSEC validation, controlled resolvers and DNS query logging address both. Read our guides to DNS tunneling and DNS data exfiltration; for the redirection side, see our DNS spoofing guide.
Web applications and APIs are the most exposed code most organizations run, and the OWASP Top 10 is the standard list of their most critical risks. ATT&CK deliberately stays coarse here and records most of these flaws as Exploit Public-Facing Application (T1190), so the CWE and CAPEC catalogs give the finer detail.
SQL injection happens when an application builds a database query from untrusted input, so the input changes the query's logic instead of being treated as data. Depending on the query, an attacker can read, change or delete data and sometimes reach the underlying server. The MOVEit Transfer flaw, CVE-2023-34362, was a SQL injection rated CVSS 9.8 by NVD and added to CISA's Known Exploited Vulnerabilities catalog on June 2, 2023. Parameterized queries are the fix. Our full guide explains what SQL injection is and how to test for it safely.
Cross-site scripting lets an attacker get their own script to run in another user's browser in the context of a trusted site, usually because the site reflects or stores input without encoding it. The script can act as the victim within that site, change what the page shows, or steal session tokens, which ATT&CK covers as Steal Web Session Cookie (T1539); malicious scripts planted on legitimate sites also feed Drive-by Compromise (T1189). Context-aware output encoding, a strict Content Security Policy and HttpOnly cookies are the core defenses. Our guide to cross-site scripting covers stored, reflected and DOM-based XSS.
Cross-site request forgery tricks a logged-in user's browser into sending an unwanted request, such as changing an email address, to a site that trusts that browser's cookies. The attacker never sees the response; they borrow the victim's session to perform an action. CSRF is cataloged as CWE-352 and attack pattern CAPEC-62 rather than as an ATT&CK technique, because it is a web-application flaw rather than an adversary behavior on an enterprise network. Anti-CSRF tokens, SameSite cookies and origin checks prevent it. See what CSRF is for browser defaults and testing.
Server-side request forgery makes a server fetch a URL the attacker chooses, so the request comes from inside the trust boundary. Attackers use it to reach internal services and, in the cloud, instance metadata endpoints that hand out credentials, which ATT&CK tracks as Cloud Instance Metadata API (T1552.005). Microsoft Exchange's ProxyLogon flaw, CVE-2021-26855, was an SSRF (CWE-918) published by NVD on March 3, 2021 and later flagged by CISA as used in ransomware campaigns. Allowlisted destinations and IMDSv2-style metadata protection are the key fixes. Our guide explains what SSRF is.
An insecure direct object reference (IDOR) exists when an application lets a user access a record just by changing an identifier, such as an invoice number in a URL, without checking that the record belongs to them. It is cataloged as CWE-639, Authorization Bypass Through User-Controlled Key, and sits under Broken Access Control, A01 in the OWASP Top 10 2025. Scanners miss most IDORs because the response looks normal; finding them takes testing with two accounts and a role matrix. Our guide explains what IDOR is and how it is tested.
A buffer overflow happens when a program writes more data into a memory buffer than it can hold, overwriting adjacent memory. In unsafe languages such as C and C++ this can crash the program or let an attacker redirect execution. It is cataloged as CWE-120 and attack pattern CAPEC-100, and ATT&CK records the result as T1190 on servers or Exploitation for Client Execution (T1203) on endpoints. Ivanti Connect Secure's stack-based buffer overflow, CVE-2025-0282, was added to CISA's KEV catalog the day NVD published it, January 8, 2025, which is exactly the edge-device pattern the DBIR describes. Memory-safe languages, compiler hardening and fast patching of internet-facing appliances are the defenses. Our buffer overflow guide explains how stack and heap overflows work and how to prevent them.
These attacks are less about a single bug and more about trust: trust in software you have not seen, vendors you depend on, people you employ and AI systems you deploy.
A zero-day is a vulnerability that attackers exploit before the vendor has released a fix, so defenders have had zero days to patch. Most zero-days are memory corruption, injection or authentication flaws like those above; what makes them a distinct attack type is the timing. ATT&CK maps them to whatever the exploit achieves, typically T1190 for internet-facing systems or Exploitation for Privilege Escalation (T1068) on a host. Log4Shell, CVE-2021-44228, was published by NVD and added to the KEV catalog on the same day, December 10, 2021. Because you cannot patch what is unknown, the defenses are attack surface reduction, segmentation, EDR and rapid patching once fixes ship. See our zero-day exploit guide.
A supply chain attack compromises a supplier, software component or service provider in order to reach that supplier's customers. ATT&CK tracks it as Supply Chain Compromise (T1195) under Initial Access. Two dated examples show the range: CISA issued Emergency Directive 21-01 on December 13, 2020 in response to the SolarWinds Orion code compromise, and the XZ Utils backdoor, CVE-2024-3094, was malicious code discovered in upstream xz release tarballs starting with version 5.6.0 in March 2024. The SolarWinds operation was attributed to APT29, which is run by Russia's foreign intelligence service; our cyber warfare statistics track state-sponsored activity like it. The 2026 DBIR puts numbers to the risk: third-party involvement rose 60% in a year and now appears in 48% of breaches. Our guide to supply chain attacks covers vendor assessment and software bills of materials.
CISA defines an insider threat as the threat that someone with authorized access will use it, intentionally or unintentionally, to harm the organization. Malicious insiders steal data or sabotage systems; negligent insiders misdeliver email or misconfigure storage. ATT&CK has no insider-only technique because insiders use legitimate access, which it records as Valid Accounts (T1078), followed by Exfiltration techniques such as Exfiltration Over Web Service (T1567). In the 2026 DBIR's Privilege Misuse pattern (1,141 incidents, 766 breaches), every breach involved internal actors, and the top motive was convenience (60%) ahead of financial gain (33%), a reminder that many insider incidents are policy shortcuts rather than theft. Least privilege, data loss prevention and user behavior analytics are the main controls. See our insider threat statistics.
AI changes attacks in two ways. First, attackers use generative AI to scale existing attacks: the 2026 DBIR found that the median threat actor it tracked researched or used AI assistance in 15 different documented techniques, and MITRE ATLAS tracks Generate Deepfakes (AML.T0088) for synthetic voice and video used in impersonation. Second, AI applications are a new target. Prompt injection, ATLAS technique AML.T0051 and LLM01 in the OWASP Top 10 for LLM Applications, smuggles instructions into an AI model's input so it ignores its rules, leaks data or misuses connected tools. Defenses include treating all model input as untrusted, limiting tool permissions and verifying payment requests out of band. Read our guides to prompt injection attacks and deepfake statistics.
Most of the 20 attack types are ways in or ways to cause impact. What turns a single compromised mailbox into a company-wide ransomware event is what happens in between. Two ATT&CK tactics do most of that work:
The table below shows a typical chain and the control that breaks each link. It is an illustrative pattern drawn from the techniques above, not a specific incident.
| Step | Attack type used | ATT&CK tactic | Control that breaks the link |
|---|---|---|---|
| 1 | Phishing email or exploited edge device | Initial Access | Phishing-resistant MFA; patch internet-facing systems first |
| 2 | Malware or script execution | Execution | EDR, allowlisting, script logging |
| 3 | Credential dumping or infostealer | Credential Access | Credential Guard, LAPS, no cached admin credentials |
| 4 | Local or domain privilege escalation | Privilege Escalation | Least privilege, patching, tiered admin accounts |
| 5 | Pass-the-hash or remote services | Lateral Movement | Segmentation, restricted admin logons, monitoring |
| 6 | Ransomware or data theft | Impact, Exfiltration | Offline backups, egress monitoring, response plan |
Defenders win by breaking the chain at the cheapest point, which is why controls at steps 1 and 3 pay off against so many attack types at once.
No single product covers 20 attack types, but a short list of controls covers most of them. Prioritize by the DBIR numbers: credential abuse, vulnerability exploitation and phishing first.
| Control | Attack types it blunts | How to verify it works |
|---|---|---|
| Phishing-resistant MFA (FIDO2 or passkeys) | Phishing, password attacks, credential theft, MITM phishing kits | Test login flows; attempt a lab adversary-in-the-middle relay in an authorized test |
| Risk-based patching of internet-facing systems | Zero-days, buffer overflows, SQL injection in products, edge-device exploits | Track time to patch KEV-listed flaws; external attack surface scans |
| Secure coding and application testing | SQL injection, XSS, CSRF, SSRF, IDOR | Code review plus authenticated web application penetration tests |
| EDR with script and credential-access monitoring | Malware, fileless malware, credential dumping, ransomware | Purple team or breach-and-attack simulation exercises |
| Least privilege and tiered administration | Privilege escalation, lateral movement, insider threats | Access reviews; internal penetration test from a standard user |
| Network segmentation and egress control | Lateral movement, DNS tunneling, data exfiltration | Segmentation testing; review DNS and egress logs |
| Payment verification out of band | BEC, deepfake-assisted fraud | Tabletop exercise with finance; call-back procedure audit |
| DDoS protection and capacity planning | DoS and DDoS | Authorized load and DDoS resilience testing |
| Offline, tested backups | Ransomware, destructive attacks | Timed restore tests |
| Vendor and dependency management | Supply chain attacks | Software bill of materials review; third-party assessments |
| Security awareness with easy reporting | Phishing, vishing, smishing, pretexting | Report rates in simulations, not just click rates |
The last row deserves emphasis. The 2026 DBIR found a median click rate of 1.4% in email phishing simulations but closer to 2% for phone-centric lures such as texts and voice calls, a 40% difference. Training that only covers email misses the channels attackers are moving to. Clicks never reach zero, so a fast report is what lets the security team pull a malicious message and reset exposed accounts.
Knowing the types of cyber attacks is only half the job. The other half is checking which ones would actually work against your environment. That is what a penetration test does: authorized testers use the same techniques as real attackers, within an agreed scope and rules of engagement, and report what they could reach and how to fix it.
Different test types map to different attack families:
Testing is lab-safe by design: it happens only on systems you own or are authorized to test, under written scope, and it never replaces patching or monitoring. A clean test also does not guarantee security; it shows which attack paths were open on the day of testing.
The main types are phishing and other social engineering, business email compromise, password and credential attacks, malware and ransomware, denial-of-service and DDoS, man-in-the-middle and DNS attacks, web application attacks such as SQL injection, XSS, CSRF, SSRF and IDOR, memory corruption flaws such as buffer overflows, zero-day exploits, supply chain attacks, insider threats and AI-powered attacks such as prompt injection and deepfakes.
In Verizon's 2026 DBIR, exploitation of vulnerabilities was the most common way into breached organizations at 31%, ahead of phishing (16%) and credential abuse (13%), and ransomware was present in 48% of breaches. Denial of service remains a frequent incident type, with 5,514 incidents in the same dataset, though it rarely leads to a data breach.
For most organizations, the highest-impact types are ransomware, credential abuse, exploitation of internet-facing vulnerabilities, phishing and business email compromise. They combine high frequency in breach data with direct financial impact, and ransomware hits small and medium-sized businesses hardest.
ATT&CK does not classify attacks by name. It describes adversary behavior as tactics, the goal of each step such as Initial Access or Impact, and techniques, the method such as T1566 Phishing or T1486 Data Encrypted for Impact. Mapping an attack type to its techniques shows where it fits in an intrusion and which detections apply.
A threat is a potential source of harm, such as a criminal group or an insider with too much access. An attack is the actual attempt to exploit a weakness. Threat intelligence tells you who might attack; knowing attack types tells you how, so you can test and close those paths.
Start with phishing-resistant MFA on email and remote access, automatic patching with priority for internet-facing systems, EDR on endpoints, offline backups with restore tests, and a call-back rule for payment changes. Then test those controls, for example with a scoped penetration test of your external perimeter and Microsoft 365 or Google Workspace setup.
Twenty attack types can look overwhelming, but most real breaches follow a handful of paths: stolen or guessed credentials, an unpatched internet-facing system, a convincing phishing message, then privilege escalation and lateral movement toward ransomware or data theft. Close those paths first, then verify the result from an attacker's point of view.
DeepStrike's penetration testing services include manual web application, network and cloud penetration testing, social engineering assessments and red team engagements, with reports that give reproduction steps, root causes and remediation guidance for every validated finding. If DDoS resilience is a concern, ask about DDoS testing when you contact the team.
Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.
Stay secure with DeepStrike penetration testing services. Reach out for a quote or customized technical proposal today
Contact Us
