STOP. Please. Just stop. No more. We as a community (the infosec community) must band together and collectively agree to stop creating new phishing name variants. It’s gone too far. There’s too many! Won’t someone think of the aspiring CISSPs? In addition to cramming fire suppression factoids and bollard types into their heads, they will also need to memorize every god forsaken -ishing term too. Back in my day you had just a few, e.g. phishing, vishing, spear phishing, whaling, blah blah - and this was still way too many. What’s with us infosec folks? Why do we do this to ourselves? (Theory: self-loathing, it actually explains a lot about infosec practitioners really). But it was the way it was, and I never complained.

But then, a few years ago, Coinbase dropped their infamous QR Code Super Bowl ad and every single infosec influencer and security vendor had a “Quishing” article out within 24 hours. I distinctly remember complaining about this a few years ago, but I ultimately let it go. But today, I came across this extremely cursed blog post from Zimperium, titled “Hidden in Plain Sight: PDF Mishing Attack”. No! STOP.

First of all, this wasn’t even their first usage of the “term” (know that I’m using those quotes very sarcastically) Mishing. To understand it, you have to go back to this post where they explain that mishing is some sort of composite form of phishing which includes a bunch of other established phishing variants (e.g. vishing, smishing, quishing, etc…) What? So it isn’t even its own thing? Why does this need to exist? Let me answer that. It doesn’t. It shouldn’t.

What’s wrong with just using a descriptive, distinct word as a prefix for different types of phishing variants? Y’know, like “Spear Phishing”. There are plenty of other examples of how we’ve done this in sane way, e.g. Angler phishing, Clone Phishing, double-barrel phishing, Deepfake phishing, search engine phishing, etc… Now granted, I don’t love these either, but imagine if those who had coined these terms had instead gone with things like (respectively) “angishing”, or “clishing”, or “dubba-ishing”, or “deepishing“… *shudders*. You see how ridiculous that sounds? I’d even settle for coming up with a completely new term, like what we did with “Whaling” or Pharming. At least there’s some points for creativity. But no, Zimperium thought they could play God, and breathe life into this abomination.

I won’t stand for it. I’m going to use my platform, and what influence I have (and I can’t emphasize enough how little that probably is), to stir collective action. No more -ishings. We must band together. Take the pledge, sign this petition, get the word out, don’t breathe further life into these terms, don’t legitimize them in any way. I call them out here only to shame them and the would-be influencers-turned-pariahs who were responsible for their creation. I hope you’ll join me.

Because if we don’t do something now. Who knows what the future will look like. Think you have it hard now with all the terms and acronyms you have to remember? It could be a lot worse.

Read more here.