Phishing is the tool of choice for malign actors to exfiltrate credentials and sensitive information that can be exploited for their own gain, steal identities and defraud people. It can be a broad campaign or highly targeted to individuals as spear phishing or high-ranking executives as whaling.

We set out why it works in our comprehensive article.