Three Threats, Three Different Mechanisms
Cyber security is about protecting computer systems, networks and data from threats.
Most attackers want the same kinds of things: personal data, passwords, money, or access to a system they are not allowed to use. What makes each threat different is how the attacker tries to get it.
So before learning any definitions, ask one question about every attack:
| Threat | What it attacks | In one line |
|---|---|---|
| Phishing | The person | A fake message tricks the user into giving away data. |
| Pharming | The destination | The user types the correct address but is sent to a fake website. |
| Malware | The software on the computer | Harmful software is installed and runs on the system. |
Treat this as a learning model, not a strict classification. It gives you a quick first question to ask, but real attacks often mix the categories. For example, a phishing email can deliver malware, and some pharming attacks rely on malware. You will see examples of this later.
Where This Fits in the Syllabus
In the Cambridge IGCSE Computer Science (0478) syllabus for 2026–2028, section 5.3 Cyber security asks you to describe the processes involved in, and the aim of, a range of threats. That list includes phishing, pharming and six named malware types: virus, worm, Trojan horse, spyware, adware and ransomware.
The same section also lists brute-force attacks, data interception, DDoS attacks, hacking and social engineering. This lesson focuses on phishing, pharming and malware; the Knowledge Library threats lesson covers the wider list.
Notice the wording: process and aim. A strong answer says how the attack works and what the attacker wants. Every section below gives you both.
Check Your Understanding 1
An attack sends a user to a fake website even though they typed the correct web address. Is the attack targeting the person, the destination or the software?
Check the answer
The destination. The user did nothing wrong — the route to the website was changed. That is the signature of pharming.
Phishing — Deceiving the User
Phishing is when an attacker sends a legitimate-looking message, such as an email or text message, that pretends to come from a trusted organisation. Its aim is to trick the user into giving away confidential information or doing something unsafe. A phishing message might:
- ask directly for confidential details, for example by asking the user to reply with their password or bank details
- include a link to a fake website where the user is persuaded to enter their details
- carry a malicious attachment that installs malware when it is opened
The fake-website version is the most common, and it is the one exam questions usually describe, so we follow it step by step below.
Nothing has been broken into. The attacker relies on the user believing the message and acting on it. That is why phishing is a form of social engineering: it manipulates a person rather than a machine.
| Step | What happens in a phishing attack |
|---|---|
| 1 | The attacker sends a message that appears to come from a trusted source, such as a bank, delivery company or school. |
| 2 | The message often creates pressure — for example, "your account will be closed today" — so the user acts without thinking. |
| 3 | The user clicks a link that opens a fake website designed to look like the real one. |
| 4 | The user enters personal data, such as a username, password or bank details. |
| 5 | The data is sent to the attacker, who can use it to access the account or commit fraud. |
Aim: to obtain personal or confidential data, such as login details or bank details, so the attacker can access accounts, steal money or commit identity fraud.
A worked example
A student receives this email, apparently from school IT support:
Subject: URGENT – your account expires in 2 hours
Dear student, your acount will be deleted unless you confirm your password now. Click here to verify.
The student clicks the link and sees a page that looks exactly like the school login screen. If they type their password, it goes straight to the attacker.
Look closely and the message gives itself away. These are the checks named in the syllabus — checking the spelling and tone of a communication and checking the URL attached to a link:
- Sender address: "schooI" uses a capital I instead of a lowercase l, and it is not the school's real domain.
- Spelling: "acount" is misspelled.
- Tone: urgent pressure and a threat ("will be deleted") are designed to stop you thinking.
- The request itself: genuine organisations do not ask you to confirm your password by email.
- The link: hovering over it would reveal a web address that does not belong to the school.
Check Your Understanding 2
Give two features of the example email that suggest it is a phishing attempt.
Reveal the answer
Any two of: the sender's address is not the school's real domain; the spelling mistake "acount"; the urgent, threatening tone; it asks the user to confirm a password; the link leads to a web address that is not the school's.
Pharming — Redirecting the Destination
To understand pharming, first remember how a web page is normally found. When you type a URL such as www.examplebank.example, the domain name server (DNS) looks up the domain name and returns the matching IP address. Your browser then requests the page from the web server at that IP address.
Pharming interferes with that lookup. The address information is changed so that the correct domain name now points to the IP address of a fake website. The change can be made in different places:
- by malicious code installed on the user's own device
- by tampering with the settings of the router that connects the user to the internet
- by altering the records on a DNS server
In the last two cases, nothing harmful needs to be installed on the victim's device at all.
| Step | What happens in a pharming attack |
|---|---|
| 1 | The address information is tampered with — by malicious code on the user's device, or by changing a router's settings or the records on a DNS server. |
| 2 | The tampered address information now links the genuine domain name to the IP address of the attacker's fake website. |
| 3 | The user types the correct web address. |
| 4 | The user is redirected to a fake website that looks like the real one. |
| 5 | Any personal data the user enters is captured by the attacker. |
Aim: the same as phishing — to obtain personal or confidential data such as login or bank details. The difference is the method of getting the user to the fake website.
This is why pharming is so dangerous: the user did nothing obviously wrong. They did not click a suspicious link. They typed the right address, and still arrived at the wrong place.
Phishing vs pharming
| Feature | Phishing | Pharming |
|---|---|---|
| What is attacked | The person | The destination (the address lookup) |
| How the user reaches the fake site | Clicks a link in a fake message | Types the correct URL and is redirected |
| Needs a fake message? | Yes | No |
| Needs malware on the victim's device? | Not necessarily — only if an attachment or a link installs it | Not always — the tampering can happen on the device, on a router or on a DNS server |
| Aim | The same: obtain personal or confidential data | |
Check Your Understanding 3
Why is "both send the user to a fake website" a weak answer to "Describe the difference between phishing and pharming"?
Reveal the answer
It describes what the two attacks have in common, not the difference. The difference is how the user gets there: phishing tricks the user into clicking a link in a fake message, while pharming redirects the user even when the correct web address is typed.
Phishing and pharming trick people into visiting fake websites. Malware is different: the harmful thing is the software itself.
Malware — Malicious Software
Malware is software designed to damage, disrupt, steal data from, or gain unauthorised access to a computer system.
"Malware" is a category, not a single program. The syllabus names six types. The key to learning them is to focus on two questions for each one: how does it get in or spread? and what does it do?
| Type | How it gets in or spreads | What it does | Typical aim |
|---|---|---|---|
| Virus | Attaches itself to a host file or program. It runs, and copies itself into other files, when the infected host is opened or run. | Can delete or corrupt data, or make the computer unstable. | Damage or disruption |
| Worm | A standalone program that replicates itself and spreads across a network without needing a host file or a user to run it. | Uses up bandwidth and slows networks; often carries other harmful code. | Disrupt networks or deliver other malware widely |
| Trojan horse | Disguised as legitimate, useful software. The user is tricked into installing it. It does not replicate itself. | Once installed, carries out hidden harmful actions, such as installing other malware or creating a "back door". | Gain unauthorised access |
| Spyware | Usually installed without the user's knowledge, often bundled with other software. | Secretly monitors activity — for example, recording key presses with a keylogger — and sends the data to a third party. | Steal personal data such as passwords |
| Adware | Often installed alongside free software. | Displays unwanted adverts, may redirect the browser and may track browsing habits. | Generate advertising income |
| Ransomware | Often arrives through an email attachment, a malicious download or another type of malware. | Encrypts the user's files or locks the system, then demands payment for the key to unlock them. | Extort money |
Virus, worm or Trojan horse? Focus on how it spreads
These three are the most commonly confused. One question separates them: does it need a host, and does it copy itself?
| Type | Needs a host file? | Copies itself? | How it reaches new computers |
|---|---|---|---|
| Virus | Yes | Yes | When infected files are shared and then run |
| Worm | No | Yes | By itself, across the network |
| Trojan horse | No — it pretends to be a program | No | Each user is tricked into installing it |
Ransomware typically encrypts files so they cannot be opened, and demands payment for the decryption key. Paying does not guarantee the files will be recovered.
Check Your Understanding 4
Several computers on a school network slow down at the same time. Investigators find a program that copied itself from computer to computer, even though nobody opened any files. Which type of malware is this most likely to be?
Reveal the answer
A worm. It replicated and spread across the network by itself, without a host file or any user action. A virus would need an infected file to be run.
Check Your Understanding 5
A user installs a "free photo editor". It works normally, but it also secretly records every key the user presses and sends the record to a criminal. Name two types of malware involved.
Reveal the answer
Trojan horse — it was disguised as legitimate software so the user installed it. Spyware (a keylogger) — it secretly records the user's activity and sends it to a third party.
Real Attacks Often Combine Threats
The categories are separate, but real attacks are not always tidy. One incident can involve more than one threat working together. Read each scenario, decide what is happening, then reveal the explanation.
Scenario A — The parcel that never was
A text message says a parcel could not be delivered and asks the user to pay a small redelivery fee using a link. The link opens a page that looks like the delivery company's website, and the user enters their card details.
Reveal the analysis
Phishing. A legitimate-looking message impersonates a trusted organisation and persuades the user to click a link and enter card details on a fake website. It is not pharming, because the user followed a link in the message instead of typing the real address.
Scenario B — The right address, the wrong website
Last week a student installed a "free game" from an unofficial site. Today they type their bank's correct web address, but arrive at a convincing fake login page.
Reveal the analysis
Trojan horse and pharming. The game was a Trojan horse: disguised as useful software, it installed malicious code. That code changed the address information on the computer, so the correct URL now leads to a fake website — that redirection is pharming.
Scenario C — The invoice attachment
An office worker receives an email claiming to be an unpaid invoice from a supplier. They open the attached file. That evening, every document on the shared drive becomes unreadable and a message demands payment to restore them.
Reveal the analysis
Phishing and ransomware. The email impersonated a trusted supplier to persuade the worker to open the attachment (phishing). The attachment delivered ransomware, which encrypted the files and demanded payment for the key.
Scenario D — The pop-up storm
After installing a free music converter, a user's browser keeps showing unwanted adverts and their home page has changed to an unfamiliar search site.
Reveal the analysis
Adware. It was installed alongside free software, displays unwanted adverts and redirects the browser. If it also tracks browsing habits and sends them to a third party, it shows spyware-like behaviour too. Either way, anti-malware should be used to remove it — Part 2 explains how.
The Complete Comparison
Use this table to revise. The last column is the clue that usually identifies the threat in an exam scenario.
| Threat | Process | Aim | Clue in a question |
|---|---|---|---|
| Phishing | Fake message persuades the user to give away data — most often on a fake website, but also by replying directly or opening a harmful attachment. | Obtain personal data | "An email that appears to be from…" |
| Pharming | Address information is tampered with (on the device, a router or a DNS server) so the correct URL leads to a fake website. | Obtain personal data | "Typed the correct address but…" |
| Virus | Attaches to a host file; replicates when the host is run. | Damage or corrupt data | "Infected file", "attached to a program" |
| Worm | Standalone; replicates across a network by itself. | Spread widely; use up bandwidth | "Spread with no user action" |
| Trojan horse | Disguised as legitimate software; user installs it. | Gain unauthorised access | "Appeared to be a useful program" |
| Spyware | Secretly monitors activity, e.g. key presses, and sends data on. | Steal personal data | "Recorded", "monitored", "keylogger" |
| Adware | Displays unwanted adverts; may redirect and track. | Advertising income | "Pop-ups", "unwanted adverts" |
| Ransomware | Encrypts files or locks the system; demands payment. | Extort money | "Files could not be opened… demanded payment" |
How Can These Threats Be Reduced?
Knowing how an attack works tells you how to defend against it. Here is a first look; Part 2 of this series explains each defence properly.
| Threat | Helpful protection | Why it helps |
|---|---|---|
| Phishing | Check the spelling and tone; check the URL attached to a link; contact the organisation using a trusted method. | Phishing only works if the user believes the message and follows the link. |
| Pharming | Anti-malware; automated software updates; use HTTPS (SSL) sites and never ignore a certificate warning. | Anti-malware removes the code when pharming relies on malware on the device. A certificate warning, or a site that normally uses HTTPS suddenly not doing so, can reveal a fake site whichever way the redirect was done. |
| Malware | Anti-malware (including anti-virus and anti-spyware); firewalls; automated software updates; download only from trusted sources. | Stops known malware, blocks unwanted traffic and fixes weaknesses that malware exploits. |
| Ransomware | All of the malware defences, plus regular backups stored separately. | Backups do not prevent the attack, but they let the files be restored without paying. |
Exam Focus — Describe the Process and the Aim
These are original FutureLogic practice questions in the Cambridge style. Try each one before revealing the model answer. The marks shown are only a guide: a model answer shows the kind of points examiners look for, but it cannot guarantee marks. Real mark schemes decide, and they accept a range of correct points.
Question 1 (4 marks)
Describe the process of pharming and state its aim.
Reveal the model answer
Syllabus link: 5.3.1 — describe the process and the aim of pharming.
The address information used to find websites is tampered with — by malicious code on the user's computer, or by altering the records on a DNS server. This means the genuine domain name is linked to the IP address of a fake website, instead of the IP address the DNS would normally return. When the user types the correct URL, they are redirected to the fake website. The aim is to obtain the user's personal data, such as login or bank details, when they enter it on the fake site.
Why this is a strong answer: it covers where the change happens, what is changed (the domain name now resolves to the wrong IP address), the redirection even with the correct URL, and the aim. "Pharming sends you to a fake website" on its own would not describe the process.
Question 2 (3 marks)
Explain the difference between a virus and a worm.
Reveal the model answer
Syllabus link: 5.3.1 — the processes involved in malware (virus, worm).
A virus attaches itself to a host file or program and only runs and spreads when the infected file is run. A worm is a standalone program. It replicates itself and spreads across a network without needing a host file or any action from the user.
Why this is a strong answer: it gives a feature of each and makes the contrast explicit — host versus standalone, user action versus spreading by itself.
Question 3 (3 marks)
A company's employees receive an email that asks them to update their payroll details using a link. Identify the threat and give two ways an employee could recognise that the email is not genuine.
Reveal the model answer
Syllabus link: 5.3.1 (phishing) and 5.3.2 — checking the spelling and tone of communications, and checking the URL attached to a link.
The threat is phishing. The employee could check the URL attached to the link, for example by hovering over it, to see whether it leads to the company's real domain. They could also check the spelling and tone of the email, as poor spelling or urgent, threatening language suggests it is fake.
Why this is a strong answer: it identifies the threat, then gives two distinct checks. Each check says what to look at and what would give the email away, which is clearer than a one-word list.
Common Cambridge Exam Mistakes
Phishing is deception using a fake message. Malware is software. A phishing email may deliver malware, but the two are different threats.
The defining feature of pharming is that the user is redirected even when they type the correct web address.
A virus needs a host file and is spread when that file is run. A worm spreads across a network by itself.
A Trojan horse is defined by its disguise. It relies on the user installing it and does not copy itself.
The syllabus asks for both. Finish with what the attacker wants: data, money, access or disruption.
Anti-virus is a defence. Learn the six malware types by name.
Quick Quiz
- In one sentence each, what does phishing attack, what does pharming attack, and what is malware?
- Why is phishing described as a form of social engineering?
- What role does the DNS normally play when a URL is typed?
- In pharming, what must happen before the user is redirected?
- Which malware type needs a host file?
- Which malware type spreads across a network without user action?
- What is the defining feature of a Trojan horse?
- What does a keylogger do, and which malware type is it?
- What does ransomware do to a user's files?
- Why do backups help against ransomware even though they do not prevent it?
Quick Quiz Answers
Reveal all answers
- Phishing attacks the person with a deceptive message; pharming attacks the destination by redirecting a correct web address; malware is harmful software.
- It manipulates a person into giving away data, rather than breaking into a system technically.
- It looks up the domain name and returns the matching IP address of the web server.
- The address information must be tampered with — by malicious code on the device, or on a router or DNS server.
- A virus.
- A worm.
- It is disguised as legitimate software so the user installs it; it does not replicate.
- It records the keys a user presses and sends them to a third party. It is a form of spyware.
- It encrypts them (or locks the system) and demands payment for the key.
- The files can be restored from the backup without paying the attacker.
Final Summary
Phishing
A fake message tricks the user into giving away data, often on a fake website.
Pharming
Tampered address information redirects a correct web address to a fake website.
Virus / Worm
Virus needs a host file. Worm spreads across a network by itself.
Trojan Horse
Disguised as legitimate software; does not replicate.
Spyware / Adware
Spyware secretly collects data. Adware shows unwanted adverts.
Ransomware
Encrypts files and demands payment for the key.