Pharming

Expanded Definition

Pharming is a redirection attack that changes where a user lands without requiring obvious interaction at the moment of compromise. Unlike phishing, which depends on a convincing lure, pharming alters the path itself through DNS poisoning, router compromise, malicious hosts file changes, or endpoint tampering. The result is a fraudulent destination that can look legitimate enough to capture passwords, payment data, session tokens, or recovery details. In security practice, pharming is best understood as an integrity failure in name resolution or traffic steering, not just a social engineering problem.

Because the user may enter the correct address and still be misdirected, detection often depends on endpoint telemetry, DNS integrity monitoring, certificate validation, and network controls aligned to the NIST Cybersecurity Framework 2.0. The term is sometimes used loosely for any fake website, but that is inaccurate. A cloned login page served through normal navigation is phishing or credential harvesting; pharming requires the redirection layer to be compromised. The most common misapplication is calling any credential theft site pharming when the real failure was a deceptive link, because that masks whether DNS, endpoint, or browser trust controls were actually broken.

Examples and Use Cases

Implementing defences against pharming rigorously often introduces more monitoring and tighter network control, requiring organisations to weigh user convenience against stronger integrity checks on resolution and routing.

• A home router is compromised and its DNS settings are altered so users who type a bank address are sent to a lookalike login page.
• Malware modifies a workstation hosts file, causing a well-known portal to resolve to an attacker-controlled server even when the URL is entered correctly.
• An enterprise DNS resolver is poisoned or misconfigured, redirecting staff to a counterfeit password-reset site that steals credentials and MFA codes.
• A fraudulent domain uses TLS and a visually similar page after the redirection layer has already been manipulated, making the attack harder to notice during normal browsing.
• A cloud or ISP routing change is abused to steer traffic through an attacker-controlled endpoint, exposing session data before users detect the anomaly.

Security teams often map these scenarios to DNS hygiene, endpoint hardening, and secure administration guidance from sources such as OWASP guidance on pharming and the broader control thinking in NIST Cybersecurity Framework 2.0. The practical distinction is that the user interaction may be entirely normal while the trust path has been silently subverted.

Why It Matters for Security Teams

Pharming matters because it bypasses many user-awareness assumptions. Security training helps, but it cannot stop a compromised DNS layer, a poisoned resolver cache, or a tampered device from redirecting traffic before the user has any chance to question it. For security teams, the risk is broader than credential theft. Pharming can undermine password resets, SSO entry points, customer portals, and admin consoles, making identity controls only as trustworthy as the routing path that reaches them. That is why browser protections, DNSSEC awareness, endpoint integrity, and monitoring for anomalous resolution patterns all sit alongside traditional awareness measures.

The identity impact is especially important in environments that depend on MFA, recovery workflows, and delegated access. If an attacker controls the destination, they can capture secrets, session cookies, or recovery answers and then pivot into accounts that were thought to be well protected. Practical response often draws on identity assurance and access validation concepts discussed in standards such as NIST SP 800-63 and on incident handling patterns within CISA guidance on deceptive web threats. Organisations typically encounter the full business impact only after legitimate users report “typing the right address but still landing on the wrong site,” at which point pharming becomes operationally unavoidable to investigate and contain.