Phishing is a form of cyber attack in which an attacker attempts to deceive individuals into revealing sensitive information such as usernames, passwords, credit card numbers, bank details, or other confidential data by masquerading as a trustworthy entity. It is primarily a social engineering attack that exploits human psychology rather than technical vulnerabilities alone. In the context of security threats, phishing represents a significant risk because it targets the weakest link in the security chain—the user. Attackers commonly use emails, instant messages, social media, or fake websites that closely resemble legitimate institutions such as banks, government agencies, or well-known companies. These communications often create a sense of urgency or fear, prompting victims to click malicious links or download infected attachments. Phishing attacks can take several forms, including spear phishing, which targets specific individuals or organizations; whaling, which targets high-profile executives; and smishing and vishing, which use SMS and voice calls respectively. Once the victim provides sensitive information, attackers may use it for identity theft, financial fraud, unauthorized transactions, or further cyber intrusions. From a legal perspective under cyber laws, phishing constitutes offenses related to identity theft,