How does a Pharming attack work?

It typically unfolds over 4 phases. It begins with: Attacker sets up a system mocking the one trusted by the users. This is usually a website that requires or handles sensitive information.

How do you prevent CAPEC-89?

All sensitive information must be handled over a secure connection.

What weaknesses does CAPEC-89 target?

CAPEC-89 exploits 2 CWE weaknesses, including CWE-346 (Origin Validation Error), CWE-350 (Reliance on Reverse DNS Resolution for a Security-Critical Action).

How severe is CAPEC-89?

MITRE rates CAPEC-89 as Very High severity with high likelihood of attack.

Standard attack pattern

Draft

CAPEC-89: Pharming

A pharming attack occurs when the victim is fooled into entering sensitive data into supposedly trusted locations, such as an online bank site or a trading platform. An attacker can impersonate these supposedly trusted sites and have the victim be directed to their site rather than the originally intended one. Pharming does not require script injection or clicking on malicious links for the attack to succeed.

Last updated June 1, 2026

Very High

Typical severity

Per MITRE

High

Likelihood of attack

Per MITRE

Related weaknesses

CWEs this targets

Standard

Abstraction

MITRE classification

Overview

CAPEC-89 (Pharming) is a standard-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.

How the attack works

The phases an attacker typically follows to carry out this attack.

Step 1
Exploit
Attacker sets up a system mocking the one trusted by the users. This is usually a website that requires or handles sensitive information.
Step 2
Exploit
The attacker then poisons the resolver for the targeted site. This is achieved by poisoning the DNS server, or the local hosts file, that directs the user to the original website
Step 3
Exploit
When the victim requests the URL for the site, the poisoned records direct the victim to the attackers' system rather than the original one.
Step 4
Exploit
Because of the identical nature of the original site and the attacker controlled one, and the fact that the URL is still the original one, the victim trusts the website reached and the attacker can now "farm" sensitive information such as credentials or account numbers.

What the attacker needs

Prerequisites

Vulnerable DNS software or improperly protected hosts file or router that can be poisoned
A website that handles sensitive information but does not use a secure connection and a certificate that is valid is also prone to pharming

Skills required

Medium skill: The attacker needs to be able to poison the resolver - DNS entries or local hosts file or router entry pointing to a trusted DNS server - in order to successfully carry out a pharming attack. Setting up a fake website, identical to the targeted one, does not require special skills.

Resources required

None: No specialized resources are required to execute this type of attack. Having knowledge of the way the target site has been structured, in order to create a fake version, is required. Poisoning the resolver requires knowledge of a vulnerability that can be exploited.

Consequences

What a successful CAPEC-89 attack can achieve.

Read Data

Affects: Confidentiality

How to mitigate it

Defenses that reduce the risk of CAPEC-89.

All sensitive information must be handled over a secure connection.
Known vulnerabilities in DNS or router software or in operating systems must be patched as soon as a fix has been released and tested.
End users must ensure that they provide sensitive information only to websites that they trust, over a secure connection with a valid certificate issued by a well-known certificate authority.

Examples

An online bank website requires users to provide their customer ID and password to log on, but does not use a secure connection. An attacker can setup a similar fake site and leverage pharming to collect this information from unknowing victims.

Frequently asked questions

Common questions about CAPEC-89.

What is CAPEC-89?: A pharming attack occurs when the victim is fooled into entering sensitive data into supposedly trusted locations, such as an online bank site or a trading platform. An attacker can impersonate these supposedly trusted sites and have the victim be directed to their site rather than the originally intended one. Pharming does not require script injection or clicking on malicious links for the attack to succeed.
How does a Pharming attack work?: It typically unfolds over 4 phases. It begins with: Attacker sets up a system mocking the one trusted by the users. This is usually a website that requires or handles sensitive information.
How do you prevent CAPEC-89?: All sensitive information must be handled over a secure connection.
What weaknesses does CAPEC-89 target?: CAPEC-89 exploits 2 CWE weaknesses, including CWE-346 (Origin Validation Error), CWE-350 (Reliance on Reverse DNS Resolution for a Security-Critical Action).
How severe is CAPEC-89?: MITRE rates CAPEC-89 as Very High severity with high likelihood of attack.

References

Attack-pattern data is sourced from the MITRE CAPEC catalog (v3.9). Weakness associations link to the corresponding CWE entries on RadicalNotion.AI.

Defend against CAPEC-89

Track the CVEs and weaknesses attackers exploit with this technique, with AI-written analysis and remediation guidance.

Start free See pricing