Phishing is a form of social engineering that attempts to steal sensitive information. An attacker's goal is to compromise systems to obtain usernames, passwords, and other account and/or financial data. They most frequently accomplish phishing attacks via email. The email includes a link that has a text showing a so called “official” website, or a reference number of an alleged communication or a placed/ rejected order. The link takes you to a fake site operated by the attacker.

From: Una Hughes [mailto:fet@mail2christian.com]
Sent: Thursday, June 1, 2017 12:26 AM
Subject: Your Order with Alibaba

Your order has been successfully canceled.
You just canceled order 443-3994-778 placed on May 31, 2017.
Status: CANCELED

Thank you for visiting Alibaba

--------------------------------------
Alibaba

Once the user visits the fake site, they may be asked overtly to enter account information such as usernames, passwords, credit card details, social security or bank account numbers. The victim may also be exposed to malware by the fake site. Taking advantage of a variety of vulnerabilities in the browser, the attacker may be able to install a Trojan Horse on the user’s computer. If done correctly, the attack can capture sensitive information without the victim even knowing that they have been compromised.