Phishing typically occurs through email, social media, or instant messaging platforms. Attackers will often create fake websites or emails that closely resemble legitimate ones, encouraging victims to click on malicious links or attachments. The goal is to harvest personal information or install malware on the victim's device. Variants of phishing include spear phishing (targeting specific individuals), whaling (targeting high-profile users), and pharming (redirecting users from legitimate websites to fraudulent ones).