Pharming redirects users to a fake lookalike site without any bad link, by poisoning DNS or tampering with local host files, so even a correctly typed web address lands on the attacker's page to harvest credentials. It is stealthier than phishing because the URL in the address bar can look completely legitimate while the page underneath is controlled by the attacker.
What is pharming, in plain English?
Pharming attacks the address-lookup system that turns a web address into a server location. Normally, when a customer types their bank's address, the Domain Name System, or DNS, points the browser to the bank's real server. Pharming corrupts that lookup so the same typed address resolves to the attacker's server instead. The victim did not click a bad link; they went where they always go, and were silently rerouted.
There are two common methods. One tampers with the local host file on an infected device, a small list the machine checks before DNS, redirecting specific sites for that one victim. The other poisons a DNS server or router, which can misdirect many users at once. In both cases the fake page is a pixel-close copy built to harvest usernames, passwords, and one-time codes.
In the fraud stack, pharming is a credential-harvesting attack that feeds account takeover. What sets it apart is the absence of the usual phishing tell: there is no suspicious link to spot and the address can read correctly, so victims and even trained staff have little reason to doubt the page.
Pharming versus phishing
What changes | Phishing | Pharming |
How the victim arrives | Clicks a malicious link or attachment | Types the correct address and is silently redirected |
The URL shown | Often slightly off or a lookalike domain | Can look completely legitimate |
What is attacked | The person's judgment | The DNS or host-file lookup |
Scale | One message per target, sent in bulk | One poisoned server can misdirect many users |
How a pharming attack works
- Corrupt — Poison the lookup. The attacker tampers with a device host file or poisons a DNS server or router so a real address resolves wrong.
- Redirect — Send to the fake site. The victim types or bookmarks the genuine address and the browser lands on the attacker's lookalike page.
- Harvest — Capture credentials. The cloned login page collects the username, password, and any one-time code the victim enters.
- Reuse — Take over the account. The stolen credentials are used to log into the real service, often from unfamiliar devices.
What it looks like in practice
In practice
Malware quietly edits the host file on a customer's laptop so that their bank's address points to an attacker server. The next morning the customer opens their usual bookmark, sees a login page identical to the real one at the address they expect, and signs in, then enters a one-time code when prompted.
Nothing seemed wrong, so no complaint is filed. Days later the fraud team sees a cluster of logins to real accounts from new devices in an unusual region, all tracing back to customers who had been silently redirected. The downstream login spike, not a reported bad link, is what surfaces the campaign.
Why it matters for operators
Pharming removes the signal most anti-phishing programs depend on. There is no bad link to report and no misspelled domain to flag, so customer reporting and URL filtering largely go quiet. The compromise happens on the lookup layer, which most customers cannot see or check. That makes the downstream login pattern the practical detection point: a spike of authentications from odd devices, geographies, or networks after a redirect campaign is often the first visible tell.
Defenses sit on both sides. On the infrastructure side, DNS security such as DNSSEC, hardened routers, and endpoint hygiene that catches host-file tampering reduce the redirect itself. On the account side, HTTPS certificate checks, phishing-resistant authentication, and strong device and behavioral risk scoring catch the takeover even when the credentials leak.
What to watch for
- Post-redirect login spikes. A cluster of logins to real accounts from new devices or unusual regions can signal a pharming campaign upstream.
- Certificate mismatches. A fake site rarely holds a valid certificate for the real domain, so cert warnings preceding a login are a strong tell.
- Host-file and DNS tampering. Endpoint alerts for edited host files or changed DNS settings on customer devices point to local pharming.
- Credentials working from strange places. Correct passwords used from devices and networks the customer has never touched suggest harvested logins.
- No complaint, real loss. Because victims see nothing wrong, silence is not safety; watch the data rather than waiting for reports.
Quick questions
How is pharming different from phishing?
Phishing lures you to click a bad link. Pharming needs no link at all: it corrupts the DNS or host-file lookup so a correctly typed address quietly resolves to the attacker's page. That makes pharming harder to spot.
Can the URL really look correct?
Yes. Because the redirect happens at the lookup layer, the address bar can show the legitimate domain while the page is the attacker's. The most reliable in-browser tell is a certificate warning or a missing valid HTTPS lock.
What stops pharming at the infrastructure level?
DNSSEC to authenticate DNS responses, hardened and patched routers, and endpoint protection that detects host-file tampering all reduce the redirect. Keeping local devices clean is central, since much pharming starts with malware.
How do teams detect it when the redirect is invisible?
By watching the downstream effect: bursts of logins to genuine accounts from unfamiliar devices, networks, or regions after a suspected campaign. The takeover pattern is usually more visible than the redirect itself.
Does phishing-resistant login help?
Yes. FIDO2 and passkeys bind the credential to the correct domain, so even a perfect-looking fake page cannot complete the login. That neutralizes the credential harvest even if the redirect succeeds.
Can pharming hit many people at once?
It can. Poisoning a shared DNS server or a router misdirects every user relying on it, which is why pharming can scale beyond the single-device host-file variant.
Go deeper
- FTC Consumer Advice: Scams ↗ — US consumer guidance on current scams and fraud, and how to report them.
- FBI IC3 ↗ — The FBI Internet Crime Complaint Center. Fraud reporting and annual trend reports.