A doctor receives an email about her upcoming holiday in France. When she clicks the URL website link in the email, the connection is blocked by her office firewall because it's a known malware website. Which type of attack includes a link to a malware website in an email?

The scenario describes a classic phishing attack. Phishing is a form of social engineering where an attacker sends a fraudulent message, typically an email, designed to trick a recipient into revealing sensitive information or, as in this case, deploying malware. The email about the doctor's holiday is the lure, crafted to appear legitimate and relevant, enticing her to click the malicious URL. The firewall's action confirms the link led to a known malicious site, a common payload delivery method for phishing campaigns. The personalization of the email suggests this is a specific type of phishing known as spear phishing.

A. whaling: This is a type of spear phishing that specifically targets high-profile executives or "whales" within an organization. A doctor is not necessarily a high-profile executive.
C. pharming: This attack redirects users from a legitimate website to a fraudulent one by compromising DNS servers or host files, without the user clicking a malicious link in an email.
D. spam: This refers to unsolicited bulk email. While this phishing email could be considered spam, "spam" describes the delivery method, not the specific attack type which involves deception and a malicious link.

1. Palo Alto Networks. (n.d.). What Is Phishing?. Palo Alto Networks Live Community. Retrieved from https://www.paloaltonetworks.com/cyberpedia/what-is-phishing.

Section: "How Phishing Works": "The most common phishing method involves sending an email that appears to come from a reputable source... The email may contain a link to a malicious website..." This directly supports the chosen answer.

Section: "Types of Phishing": This section defines whaling as targeting "senior executives" and spear phishing as targeting "a specific individual or organization

" which clarifies why option A is less accurate than B.

2. Palo Alto Networks. (n.d.). What Is Pharming?. Palo Alto Networks Live Community. Retrieved from https://www.paloaltonetworks.com/cyberpedia/what-is-pharming.

Section: "How Does Pharming Work?": "Pharming attacks compromise DNS servers... When a user types a website address into their browser

the DNS server is what translates that name into an IP address... In a pharming attack

the cybercriminal alters the DNS server so that the website name resolves to a malicious IP address." This confirms that pharming is a DNS-based redirection attack

unlike the scenario described.

3. Stanford University Information Technology. (n.d.). Phishing & Suspicious Email. Retrieved from https://uit.stanford.edu/security/phishing.

Section: "What is phishing?": "Phishing is a cybercrime that uses email

phone

or text messages to lure individuals into providing sensitive data... or clicking on a link to a malicious website." This academic source corroborates the definition of phishing used in the explanation.