Cyber attacks do not always start with something sophisticated. Plenty of incidents begin with something ordinary: a link clicked without checking, a password reused across services, or a device that has been waiting months for an update.
Knowing the common attack types is the cheapest way to reduce risk. Not because everything can be prevented, but because most attacks follow repeating patterns — and a pattern recognised early buys time to react before the damage grows.
This article covers 15 types of cyber attacks you are most likely to meet: how they work, what they usually target, and the prevention steps worth doing first. How we choose and layer our defences is in the Cybersecurity topic.
At a glance
- What this is: fifteen attack patterns, grouped by what they go after — people, credentials, applications, networks, and availability.
- Favourite target: accounts and passwords. Stolen credentials open almost every other door, usually quietly and without a clear trace.
- Most likely to succeed: attacks that exploit user habits rather than a genuinely new technical flaw.
- Most expensive: ransomware and payment fraud, because the damage hits operations and money at the same time.
- Biggest opportunity to improve: a different password for every account, multi-factor authentication, and separate backups that are regularly test-restored.
The 15 types of cyber attacks at a glance
The table below is the summary. Details for each attack — how it works and how to prevent it — follow in the sections after it.
| # | Attack type | Primary target | Easy-to-spot pattern |
|---|---|---|---|
| 1 | Phishing | general users | an urgent message asking you to log in or hand over personal data |
| 2 | Spear phishing | a specific person | a detailed, personal-sounding message you did not ask for |
| 3 | Whaling | executives & high-access staff | an urgent request to transfer money or share a confidential document |
| 4 | DDoS | service availability | a slow or unreachable site with no plausible traffic spike |
| 5 | Man-in-the-middle | network communication | certificate warnings, an open public Wi-Fi network |
| 6 | SQL injection | the application database | database errors in the page, input that changes page behaviour |
| 7 | Cross-site scripting | visitor sessions | code appears in a comment field or profile and then runs in the browser |
| 8 | Zero-day attack | unpatched software | the attack runs before a fix is available |
| 9 | Brute force | accounts with weak passwords | repeated failed logins against one account |
| 10 | Password spraying | many accounts at once | failed logins spread across many accounts from one source |
| 11 | Ransomware | data and operations | files will not open, a ransom note appears |
| 12 | Credential stuffing | accounts with leaked passwords | a successful login from a new device or location |
| 13 | DNS spoofing | visitors typing your domain | the page that opens differs from the address that was typed |
| 14 | Eavesdropping | data sent without encryption | legacy protocols still in use on a shared network |
| 15 | Social engineering | anyone who can be persuaded | an urgent request about access, money, or confidential data |
Attacks that target people
This group does not exploit faulty software. It exploits hurried decisions, which is why prevention here is mostly habits and procedure rather than tooling.
1. Phishing
Phishing is an attempt to trick someone through email, messages, or a fake site into handing over sensitive information such as passwords, one-time codes, or card details. The attacker poses as something trusted: a bank, a shopping service, the company you work for, or a popular platform.
Example: the victim receives an email demanding an immediate sign-in because the account is said to be about to be blocked. The link leads to a fake login page that looks almost identical to the real one.
How to spot it: urgency, deadline threats, a sender address that is similar but not identical, a link pointing at a different domain, and attachments you did not ask for.
Prevention: check the sender address, open services from a bookmark or the official address rather than from a link in a message, turn on multi-factor authentication, and remember that real institutions never ask for passwords or one-time codes by message.
2. Spear phishing
Spear phishing is phishing with aim. The attacker first gathers information about a specific target — job title, current project, colleagues, even the writing style used inside the organisation — then builds a message that sounds plausible.
Because the message is personal, this attack is far more convincing than mass phishing and much harder to spot from bad spelling or grammar alone.
Example: an employee receives a message that appears to come from their manager with a document to read before a meeting; the document contains a credential-harvesting link.
Prevention: verify sensitive requests on another channel (a call, a text message, or a conversation), do not rely on the display name in your inbox, and treat shared documents that ask you to sign in again as suspicious.
3. Whaling
Whaling targets people in significant positions — directors, executives, business owners, or officers of an organisation. They are chosen because they can approve large payments, grant privileged access, or share strategic information.
These attacks often combine social engineering with careful impersonation: signed documents, project reference numbers, and a chronology that sounds reasonable.
Prevention: use layered approval procedures for important transactions, separate the person who requests from the person who approves, run security training tailored to holders of critical access, and confirm every change of bank details through an already-known channel.
15. Social engineering
Social engineering uses psychological manipulation — trust, deference to a manager, fear of getting it wrong, or the wish to help quickly — to make someone give away information or take an action. The attacker may pose as a colleague, an IT staffer, a vendor, an auditor, or anyone who looks authorised.
Unlike technical exploits, social engineering goes straight at people, and it is often the way in for other attacks, ransomware included.
Prevention: verify identities through a channel you already know, do not rush requests that involve access, money, or confidential information, and build a culture where stopping to ask is the correct move rather than a sign of weakness.
Attacks that target credentials
Accounts are the master key to almost every service, so it is no surprise that attackers keep going after them. The three patterns below are the most common, and all three rest on weak or reused passwords.
9. Brute force attack
Brute force tries many password combinations in sequence until one works. It does not look for cleverness in the system, only for opportunity: short passwords, dictionary words, or patterns that are easy to guess such as birth dates and pet names.
Example: an account protected by a four-digit password receives thousands of login attempts in minutes. The same approach is used to guess PINs, one-time codes, or invitation links.
Prevention: use long, unique passwords, turn on MFA, apply attempt limits and progressive delays (rate limiting), and monitor unusual patterns of failed logins.
10. Password spraying
Password spraying is the mirror image of brute force: instead of many passwords against one account, it tries one or a few common passwords against many accounts. The goal is to avoid the account lockout that usually triggers after several failed attempts on a single account.
It is very effective in large organisations with thousands of accounts, because there are almost
always a few people using something like Password123 or the company name followed by a year.
Prevention: block easily guessed passwords, use MFA, watch for login attempts spread from a single IP address or region, and detect a successful login that follows a large number of failures.
12. Credential stuffing
Credential stuffing takes username and password pairs leaked from another service and tries them against accounts elsewhere. Because many people reuse the same password, one old breach can open an account that has nothing to do with the original incident.
This attack runs quietly: there is no guessing, because the credentials are already known — just fast matching at scale.
Prevention: use a different password for every account and manage them with a password manager, turn on MFA, check user databases against known breach lists where available, and treat logins from new devices or locations as a signal.
Attacks that target applications and data
This group goes after flaws in software: how input is handled, how output is rendered, and how quickly fixes are applied. Most of the prevention is good development practice rather than an extra tool.
6. SQL injection
SQL injection happens when user input can influence the commands an application sends to its database. If the application builds queries by concatenating raw text from a form, a search box, or a URL parameter, an attacker can add a piece of their own command.
The result can range from reading data that should never be visible, to modifying or deleting records, to using the same database as a route into other systems.
Prevention: use parameterised queries or prepared statements for every data access, validate and restrict input to the shape you expect, limit database account privileges to what is actually needed, and never show database error details to visitors.
7. Cross-site scripting (XSS)
Cross-site scripting lets malicious code be injected into a web page and executed in another visitor’s browser. The opening appears when user-supplied data is rendered back into the page without proper handling — in a comment field, a profile name, or search results.
Because that code runs inside the real page, it can read login sessions, perform actions as the visitor, or alter what the page shows so people hand over information willingly.
Prevention: encode output for its context, validate and sanitise input, avoid inserting raw HTML from untrusted sources, apply a Content Security Policy, and use cookie attributes that limit session script access.
8. Zero-day attack
A zero-day attack exploits a security flaw that is not publicly known, or is known but has no widely available fix. With no patch to install, defence has to lean on limiting the damage rather than stopping entry.
These attacks rarely single out a small site. They tend to spread broadly through automation, and the first victims are systems that are behind on updates or run software with far more privilege than needed.
Prevention: keep the system and its dependencies updated, reduce the number of services exposed to the internet, apply defence-in-depth so one flaw does not open everything, limit privileges, and monitor for unusual activity so the impact can be contained faster.
Attacks that target networks
Here the attacker does not break into your server; they get onto the path between a user and the service. That is why the risk is highest on shared networks nobody fully controls.
5. Man-in-the-middle (MITM)
In a man-in-the-middle attack, the attacker tries to sit between two parties that are communicating so they can eavesdrop, record, or manipulate the data in transit. That position can be obtained through a fake Wi-Fi network, a network device already under their control, or by redirecting traffic.
The risk rises when people use an unsecured public Wi-Fi network, especially if the sites they open still use plain HTTP.
Prevention: use HTTPS on every page, enable HSTS, use a VPN when you must work on an untrusted network, avoid sensitive transactions on public networks, and never click past a certificate warning in the browser.
13. DNS spoofing
DNS spoofing, or DNS cache poisoning, tries to send users to the wrong address even though they typed the correct domain name. Because most people treat a domain name as a mark of authenticity, a fake page appearing at the right address is far more convincing.
The goal may be stealing login details, distributing malware, or redirecting traffic to an ad page.
Prevention: use a trusted DNS service from a provider that takes security seriously, enable DNSSEC where available, protect the domain registrar account with MFA and a domain lock, and make sure the site always serves a valid HTTPS connection.
14. Eavesdropping
Eavesdropping is the interception of digital communication to obtain what is being sent: passwords, session tokens, message content, or personal data. Unlike attacks that alter data, eavesdropping usually leaves no trace in the application, because the data still arrives intact.
The risk is highest when data travels unencrypted — over HTTP, FTP, or legacy protocols inside an office network.
Prevention: encrypt data both in transit and at rest, retire old insecure communication protocols, separate work devices from guest networks, and restrict who can reach internal network paths.
Attacks that target availability and data
The two patterns below are felt fastest because they hit operations directly: one makes a service unusable, the other makes data unreadable.
4. DDoS attack
A Distributed Denial of Service (DDoS) attack aims to make a digital service hard or impossible to reach by flooding the server with a very large volume of traffic. The traffic usually comes from many compromised devices — computers, servers, and internet-connected household devices.
There are several forms: saturating bandwidth, exhausting active connections, or sending heavy application requests such as repeated searches and report generation.
Impact: the site becomes slow, the application is unreachable, online services stop temporarily, and traffic and support costs rise at the same time. In some cases a DDoS is also used as cover so an attacker can work unnoticed on another path.
Prevention: use DDoS protection from a provider that specialises in it, put a CDN in front so traffic is filtered at the edge, apply rate limiting, set up traffic monitoring and alerts, and have a plan to block the source without blocking legitimate visitors.
11. Ransomware
Ransomware is malware that encrypts or locks data, then demands payment to restore access. In some cases the attacker also steals data before encrypting it and threatens to publish it if the ransom is not paid — so paying is no guarantee the problem ends.
As noted in our DevOps & Sysadmin topic, ransomware usually gets in through three doors: a malicious attachment or link, an account with privileged access, and a service that has not been updated.
Prevention: keep separate backups that cannot be reached from the same network, apply updates routinely, limit administrator rights, use endpoint protection, keep everyday accounts separate from administrative accounts, and train people to recognise dangerous attachments and links.
Why cyber attacks so often succeed
Many attacks do not exploit technology alone; they exploit the habits of the people using it. Reused passwords, unpatched systems, old accounts still active, and urgent requests answered without verification are opportunities that repeat in almost every incident.
Three patterns explain most of the success:
- People move faster than process. An urgent request with a short deadline pushes people towards the quickest route, and the quickest route almost always skips verification.
- One credential opens many doors. Because one account is often used across several services, a single leaked password can grant access far beyond the service it came from.
- Patching waits; attackers do not. A flaw that already has a fix stays dangerous for as long as the fix is not installed, and that gap is exactly what gets used.
Security therefore should not rest on a single tool. Durable protection usually combines technology, written procedure, and user awareness refreshed on a schedule — in line with our code standards and the ops habits we use day to day.
Basic steps to reduce your risk
Not every step needs a new budget or a large project. The habits below already close most of the entry points attackers use most often:
- Use long, unique passwords for every account, managed with a password manager.
- Turn on multi-factor authentication, above all for email, DNS, hosting, and repositories.
- Keep operating systems, applications, plugins, and dependencies updated — on a schedule rather than when someone remembers.
- Avoid suspicious links and attachments, and verify sensitive requests on another channel.
- Back up important data regularly, keep the copies separate, and test the restore.
- Apply least privilege to limit access, then revoke access that is no longer needed.
- Monitor logins and changes on important systems, and make sure the alerts reach a human.
- Train people regularly, using examples close to their everyday work.
- Write down what to do during an incident before the incident happens.
For a project that is just starting, that list can be compressed into three things in week one: multi-factor authentication on every important account, a different password for each service, and an automatic backup that has already been restored once. The rest can follow without adding much risk.
Frequently asked questions
Which types of cyber attacks happen most often?
Phishing and its variants — spear phishing and whaling — remain the most common, because they are the cheapest to run and they target people rather than software. Next come credential-based attacks such as brute force and credential stuffing, along with ransomware, which usually gets in through one of the first two.
What is the difference between phishing, spear phishing, and whaling?
All three deceive through messages, but they differ in target and level of tailoring. Phishing is sent in bulk to many people, spear phishing is tailored to a specific person or team, and whaling targets senior individuals such as directors or business owners who can approve major decisions.
What is the difference between brute force, password spraying, and credential stuffing?
Brute force tries many combinations against one account. Password spraying tries a few common passwords against many accounts at once to avoid lockouts. Credential stuffing reuses username and password pairs leaked from another service and tries them against other accounts.
Does a DDoS attack steal data?
Not directly. DDoS attacks availability, not the data itself. It can, however, be used as a distraction so that other activity — scanning, login attempts, or exploitation of a flaw — stays unnoticed while the team is busy restoring the service.
Does paying a ransomware demand resolve the problem?
There is no guarantee. Payment does not ensure the data can be restored, it can encourage a follow-up attack, and in many cases the attacker has already stolen data to keep the pressure on. The most reliable recovery path remains a separate, tested backup.
Are small sites really targeted by cyber attacks?
Yes, although often not deliberately. Most attacks run automatically and scan the whole internet without choosing victims; what matters is not the size of the site but whether there is an easy flaw to use.
Is antivirus enough to prevent cyber attacks?
No. Antivirus is a useful layer, but it does not cover phishing, reused passwords, application flaws, or misconfigured access. Better protection combines technology, procedure, and user awareness.
Conclusion
Not every cyber attack works the same way. Phishing and social engineering aim at people. Credential stuffing and brute force aim at accounts. SQL injection and XSS exploit application weaknesses. MITM, DNS spoofing, and eavesdropping go after the network. DDoS disrupts availability, while ransomware locks data and stops operations.
Recognising each pattern helps people and organisations decide which protection matters first. The point is not to memorise the names, but to understand how the risk appears, what its early signs look like, and how to reduce it — starting with the cheapest steps: unique passwords, multi-factor authentication, routine updates, and backups that can genuinely be restored.
Want to check how your site or infrastructure stands against the patterns above? Tell us what you run and we will help sequence the fixes by risk. Related reading: our guides, the code standards we use, and the ops habits that keep systems steady.
References
Sources we used while writing this article:
- OWASP — OWASP Top 10
- OWASP — SQL Injection Prevention Cheat Sheet
- CISA — Understanding Denial-of-Service Attacks
- CISA — Avoiding Social Engineering and Phishing Attacks
- NIST — Cybersecurity Framework
- MITRE — ATT&CK Knowledge Base