Which of the following types of phishing attacks allows an attacker to exploit instant messaging platforms by employing IM as a tool to spread spam?

Spimming is a specific type of spam attack that leverages Instant Messaging (IM) platforms. The term is a portmanteau of "spam" and "IM." Attackers use this method to send unsolicited messages in bulk to IM users. These messages often contain malicious links designed to spread malware, direct users to phishing websites, or advertise fraudulent services. The core characteristic of spimming is the use of instant messaging as the delivery vector for spam, which directly matches the scenario described in the question.

A. Whaling: This attack is a form of spear phishing that specifically targets high-profile individuals, such as senior executives (CEOs, CFOs), not defined by the use of IM.

B. Pharming: This is a technical attack that redirects users to a fraudulent website by compromising DNS servers or modifying a local host file, not by sending messages.

D. Spear phishing: This refers to a highly targeted phishing attack aimed at a specific individual or organization. While it could use IM, its defining feature is targeting, not the medium itself.

1. National Institute of Standards and Technology (NIST) - Computer Security Resource Center (CSRC) Glossary.

Spim: "Unsolicited commercial bulk messages sent over instant messaging (IM) systems." (This is the root term for Spimming).

Whaling: "A type of phishing that targets high-profile employees..."

Pharming: "A phishing technique that seeks to redirect a user’s web traffic to a fraudulent website..."

Spear Phishing: "A targeted phishing attack that is tailored to a specific person or organization."

Source: NIST CSRC Glossary, entries for "Spim," "Whaling," "Pharming," and "Spear Phishing." Retrieved from https://csrc.nist.gov/glossary

2. Academic Publication defining Spim/Spimming.

O. A. Mohammed, J. H. Abass, and A. J. Abboud, "A survey on phishing and its countermeasures," in 2017 Annual Conference on New Trends in Information & Communications Technology Applications (NTICT), 2017, pp. 22-27.

Reference: Section II, Part C, "Types of Phishing," defines Spim as "unsolicited instant messages." This paper categorizes it as a distinct type of phishing attack based on the delivery vector.

DOI: https://doi.org/10.1109/NTICT.2017.7976111

3. University Courseware Context.

Carnegie Mellon University, Software Engineering Institute (SEI). While not a direct course, the SEI's publications and glossaries are foundational to many academic curricula.

Reference: The CERT Guide to Coordinated Vulnerability Disclosure, Glossary, defines related terms like phishing in a manner consistent with NIST, reinforcing the standardized definitions used in academia and government. For example, phishing is defined as "A technique for attempting to acquire sensitive data... by masquerading as a trustworthy entity in an electronic communication." Spimming is a specialized form of this.

Source: The CERT Division, Software Engineering Institute, Carnegie Mellon University. (e.g., "Common Sense Guide to Mitigating Insider Threats, 6th Edition," provides context on social engineering vectors).