Pharming is an attack that sends your staff to a fake website without anyone sending them a link. Instead of relying on a phishing email, the attacker corrupts the system that turns website names into addresses — so when an employee types your bank's web address into the browser, the browser itself takes them to an attacker's server that looks identical. The user did everything right. The infrastructure lied.
TL;DR
- Pharming poisons the name-to-address lookup (DNS, router settings or a device's hosts file) so real web addresses land on fake sites.
- It is phishing without the email: no suspicious link to spot, no red flag in the message — because there is no message.
- The two main routes are DNS poisoning on the network and malware that rewrites where a device resolves names.
- The defences are structural: HTTPS certificate warnings treated as alarms, MFA everywhere, DNS filtering and router hygiene.
- Training still matters, but the lesson changes: bookmark the login page, never dismiss a certificate warning, and report a login page that feels off even when the address looks right.
What pharming means in plain terms
Every visit to a website starts with a question: where is this address? Your device asks a DNS resolver (the internet's phone book), and the answer decides which server your browser connects to. Pharming attacks corrupt that answer.
Where phishing baits the person, pharming baits the plumbing. The employee's inbox is clean, their habits are fine — and they still end up entering their credentials on a page the attacker controls. That is why pharming is one of the few attacks that defeats a well-trained click reflex on its own.
How a pharming attack actually runs
There are three working routes in 2026, and they stack:
- DNS poisoning on the network. The attacker tricks or corrupts a DNS resolver into answering yourbank.com with a fake address. Everyone using that resolver — often a whole office or ISP — is redirected at once.
- Router compromise. Home and small-office routers ship with default admin passwords. An attacker who gets into the router changes its DNS settings, and every device on that network inherits the poisoned answers.
- Malware on the device. A trojan edits the local hosts file or installs its own resolver, so that one laptop gets redirected no matter which network it joins.
The fake site then does what any phishing kit does: mirrors the real login page, captures the password, and often forwards the victim to the genuine site so nothing feels wrong. Related attacks like spoofing and credential stuffing reuse the same captured logins within minutes.
Pharming vs phishing: the distinction that matters for training
| Phishing | Pharming | |
|---|---|---|
| Delivery | An email, SMS or chat message | Corrupted DNS, router or hosts file |
| User sees | A message with a link or attachment | A normal browser visit |
| Red flags | Urgency, lookalike sender, odd link | Certificate warnings, a login page that asks for extra steps |
| Best defence | Trained reporting reflex | MFA, DNS filtering, certificate discipline |
The practical takeaway: your best-trained clicker is still exposed to pharming, and your least technical staff member can still catch it — by noticing the browser warning everyone has been trained to click through.
How to defend against pharming
No single control stops it; the layered set does.
| Layer | Control | What it does |
|---|---|---|
| Identity | Multi-factor authentication on every account | A captured password alone is worthless |
| Network | DNS filtering with known-bad domain blocking | Stops devices resolving to fake lookalike infrastructure |
| Devices | Endpoint protection and patching | Detects and removes hosts-file tampering malware |
| Infrastructure | Change router admin passwords, disable remote admin, update firmware | Closes the network-level route |
| Browser | Treat certificate errors as incidents | Legitimate sites almost never throw certificate warnings |
| People | Pharming in the training curriculum | Staff bookmark logins and report anomalies instead of dismissing them |
The people layer is where the habit forms: use bookmarks for banking and SaaS logins rather than typing addresses or clicking search results, and never proceed past a browser security warning to reach a login page. That single habit neutralises most pharming attempts — the fake site either cannot present a valid certificate or triggers a warning a bookmark user would notice.
Why training still decides the outcome
Pharming is technically silent, but it leaves traces a trained person catches:
- A certificate warning before a login is an alarm, not an inconvenience. Report it; do not click through.
- A login page that looks subtly wrong — new layout, extra fields, different wording — gets reported even when the address bar looks right.
- Anyone asked to "verify" credentials on a page they reached by typing a familiar address reports it the same way they report a phishing email.
Cyber Aware's security awareness training covers these non-email attack classes alongside the monthly phishing cadence, so staff learn one consistent rule: when something feels off, report it and let IT verify. The human risk reporting score then shows whether that habit is actually forming.
FAQ
What is pharming in cyber security? An attack that redirects users to fake websites by corrupting the DNS lookup process — on the network, the router or the device itself — so people land on attacker-controlled clones of legitimate sites without ever receiving a malicious link.
What is the difference between phishing and pharming? Phishing delivers a malicious link to the person and relies on them clicking. Pharming corrupts the address lookup so even a correctly typed address lands on the fake site. Phishing targets a person's judgement; pharming targets the infrastructure's answers.
Does HTTPS protect against pharming? Partly. A real certificate on the fake site is hard for attackers to obtain for the exact domain, so many pharming kits trigger certificate warnings or use close lookalike domains. That is why the discipline is: never dismiss a certificate warning on a login page.
How do you prevent pharming? Layer it: MFA everywhere, DNS filtering, endpoint protection, router hardening (unique admin password, current firmware, remote admin off) and training that treats certificate warnings and odd login pages as reportable events.
Is pharming still a threat in 2026? Yes. It is rarer than phishing but more damaging per hit, because it harvests credentials from careful users. It clusters around compromised routers and small-business networks without DNS filtering — exactly the environments most SMBs run.
One last thing
Check your office router today: is the admin password still the one printed on the sticker? If yes, changing it is a five-minute fix that closes the most common pharming route in small businesses. Then ask whether your team would click through a certificate warning to reach a login — if you don't know, that is a security gap assessment conversation.