Phishing attacks primarily target

Phishing is a social-engineering cyber attack in which an attacker impersonates a trusted entity, such as a bank, service provider, or colleague, through email, SMS, or a fake website, to deceive a victim into voluntarily revealing sensitive information. The technique exploits human trust and error rather than a technical flaw in physical infrastructure.

A phishing message is built to lure the recipient into typing something sensitive into a fake login page, form, or reply. The data it is designed to capture is exactly what the victim types or submits: usernames, passwords, one-time passcodes, card numbers, and other personal details. So the direct target of a phishing attack, among the given options, is user credentials and personal information.

• Hardware: physical computing equipment such as routers, servers, and storage devices. Phishing works through deceptive messages and pages, not by directly compromising physical devices.

• DNS servers: infrastructure that translates domain names into IP addresses. Attacking DNS itself is DNS spoofing or cache poisoning, a distinct network-layer attack, not the message-based credential harvesting that defines phishing.

• HTTP cookies: small session-tracking files that can be stolen through session hijacking or cross-site scripting, a different attack class from phishing's deception-based data collection.

Hence, phishing attacks primarily target user credentials and personal information.