CyberGlossary

Attacks & Threats

Pharming

Definition

An attack that silently redirects users from a legitimate site to a malicious one by tampering with DNS, hosts files, or local routing — without requiring the victim to click a link.

Pharming subverts the name-resolution or routing path so that even users who correctly type a domain end up on an attacker-controlled site that mimics the original. Techniques include poisoning DNS caches, compromising recursive resolvers, modifying the local hosts file via malware, or hijacking a home router's DNS settings. Once the victim lands on the fraudulent site, credentials, payment data, or MFA codes are harvested as if they were entering them on the real one. Defences include DNSSEC, encrypted DNS (DoH/DoT), endpoint protection against hosts-file tampering, hardened router configurations, and TLS certificate verification by users and browsers.

Examples

  • Malware modifies the Windows hosts file so that bank.example.com resolves to an attacker server with a look-alike login page.
  • Compromised home router replaces the ISP's DNS with rogue resolvers that hijack banking traffic for the entire household.

Related terms