Pharming

Pharming redirects victims from a legitimate website to a fraudulent copy by tampering with how their device resolves domain names. Unlike phishing, it needs no deceptive message and no mistaken click: the victim types the correct address, and still lands on the attacker's page.

How it works

Pharming corrupts the address-lookup step (DNS) that turns a domain name into a server address. The main variants:

• Hosts-file modification. Malware on the victim's device edits the local hosts file, mapping a bank's or webmail provider's domain to an attacker-controlled server.
• Router compromise. Attackers change the DNS settings on a home or small-office router — via default credentials or unpatched firmware — so every device behind it resolves selected domains to fraudulent servers.
• DNS cache poisoning. Corrupting a DNS resolver's cache so that everyone who relies on it is redirected for as long as the poisoned entry survives.

Once the redirect is in place, the fake site harvests whatever the victim enters — credentials, card numbers, MFA codes. Because the address bar shows the correct domain, pharming defeats the most fundamental advice in security awareness: "check the URL." Its close relative in stealth is the watering hole attack, which also compromises trusted destinations rather than luring victims to new ones.

How to defend against it

• Look for the certificate, not just the domain. A pharming site on the real domain name generally cannot present a valid TLS certificate for it. Browsers' invalid-certificate warnings are the one visible symptom — teach employees to treat them as a full stop, never a click-through.
• Harden the resolution path. Use DNS services with security filtering (and DNS-over-HTTPS where practical), patch and de-default router admin credentials, and let endpoint protection watch for hosts-file changes.
• Make stolen credentials less useful. Phishing-resistant MFA limits the value of anything a fake page captures — the same logic behind defending against phishing generally, and a behavior worth reinforcing through security awareness training.