Phishing is one of the oldest and most successful tricks in the cybercriminal playbook. Long before today’s fake bank alerts, package delivery texts, QR code scams, and artificial intelligence-generated messages, criminals were already learning that it was often easier to trick a person than to break through a computer system. The history of phishing shows how a simple idea—pretending to be someone trustworthy—grew into one of the most common ways criminals steal passwords, money, and personal information.

This week's issue brings the return of recognizing our weekly "Cybersecurity All-Stars". I had stopped doing this for some reason. So, beginning this week that error will be corrected.

Week of July 27-August 2

This week's "Cybersecurity All-Stars" are Kris Hines, Joe Miles & Sean Mitchell who all reported suspicious messages using Barracuda's sell-reporting Outlook tool.

Well done. Stop by the IT Department to claim your All-Star merch and show off your cybersecurity skills to your work mates.

As a Chief Information Security Officer, I receive regular reports from the Center for Internet Security (CIS). I am not sure why I haven't thought of this sooner, but "Cybersecurity Friday" is a great place to share these important security alerts. Beginning with this issue, I will share the alerts I have received.

Take the time to review them and if they apply to you, take action and as always, feel free to reach out to me with any questions.

This week, Google, Microsoft & Adobe all have discovered vulnerabilities.

• Multiple vulnerabilities have been discovered in Google Chrome.

• Multiple vulnerabilities have been discovered in Microsoft products.

• Multiple vulnerabilities have been discovered in Adobe products.

The word phishing is a play on the word “fishing.” Attackers cast out bait—usually a fake message—and hope someone bites by clicking a link, opening an attachment, entering a password, or sharing sensitive information. The unusual spelling with “ph” is often connected to early hacker culture and “phone phreaking,” a term used for people who explored or manipulated telephone systems. Over time, phishing became the name for scams that use deception to hook victims online.

Phishing became widely recognized in the mid-1990s, when America Online, better known as AOL, was one of the most popular ways people connected to the internet. Many users were new to online communication, and attackers took advantage of that trust. Scammers created screen names that looked like official AOL support or billing accounts and sent messages asking users to “verify” passwords, billing information, or account details.

These early scams were crude by today’s standards, but they worked because they looked believable to people who had little experience spotting online fraud. Some attackers used stolen or randomly generated credit card numbers to create new accounts, then used those accounts to send more fake messages. This pattern—steal access, use that access to reach more people, and repeat—still appears in modern attacks.

As email became more common, phishing moved beyond chat rooms and internet service accounts. Attackers began sending messages that looked like they came from banks, online stores, delivery companies, employers, and government agencies. Some messages tried to steal usernames and passwords. Others carried malicious attachments or links that installed malware.

One of the most famous examples was the “ILOVEYOU” or “Love Bug” worm in 2000. It spread through email with a tempting subject line and attachment, showing how quickly a message designed around curiosity and trust could move around the world. While not every malware outbreak is phishing in the strictest sense, the incident helped demonstrate a key lesson: people are more likely to click when a message feels personal, urgent, or emotionally interesting.

During the 2000s and 2010s, phishing became more organized and more profitable. Criminal groups built fake banking websites, copied company logos, registered look-alike domain names, and sent large volumes of email to millions of people. Instead of asking for an AOL password, attackers wanted online banking credentials, credit card numbers, payroll access, tax information, and business email accounts.

Businesses also became major targets. Spear phishing focused on specific people or organizations. Business email compromise scams tricked employees into sending payments, changing direct deposit information, buying gift cards, or sharing sensitive files. Instead of casting a wide net, criminals researched their victims and created messages that looked like normal business requests.

Today, phishing is no longer limited to email. Criminals use text messages, phone calls, social media, messaging apps, QR codes, fake advertisements, search results, and even collaboration tools. Smishing uses text messages. Vishing uses voice calls. QR code phishing tries to send people to fake websites by hiding the dangerous link inside a code. Fake support chats and social media messages can also be used to steal account access.

The technology changes, but the pattern stays familiar. The attacker creates a believable story, adds pressure or curiosity, and asks the victim to take an action. That action might be clicking a link, entering a password, approving a login request, scanning a code, calling a fake number, or downloading a file.

Phishing has lasted for decades because it targets human behavior. People are busy. They trust familiar names and logos. They react to warnings about locked accounts, missed payments, failed deliveries, refunds, security alerts, or urgent requests from supervisors. Criminals know that one rushed click can open the door to stolen credentials, malware, ransomware, or financial fraud.

Modern phishing is also harder to spot because attackers can personalize messages with information found in data breaches, social media posts, public records, and company websites. Artificial intelligence can help criminals write cleaner messages, translate scams into different languages, and create more convincing wording. That means old advice like “look for bad spelling” is no longer enough.

The history of phishing teaches an important lesson: attackers adapt to whatever technology people are using. When people used AOL chat rooms, scammers used fake AOL messages. When email became common, phishing moved to email. When phones became central to daily life, scams moved to text messages and mobile apps. As QR codes, cloud services, remote work, and artificial intelligence became more common, phishing followed those trends too.

The best defense is not just one tool or one warning sign. It is a combination of awareness, strong passwords, multi-factor authentication, software updates, safe browsing habits, email protections, and a willingness to pause before acting. Phishing depends on speed and trust. Slowing down takes away some of the attacker’s advantage.

Phishing has changed a great deal since the early days of AOL, but its foundation remains the same: deception, trust, and timing. Criminals keep changing the bait, but they are still fishing for the same things—passwords, money, access, and personal information. By understanding where phishing came from and how it has evolved, we can become better at recognizing the next version before we take the bait.

Next week we turn our history lesson to Ransomware.