Phishing is social engineering that tricks users into performing actions like clicking malicious links or entering credentials. It targets human behavior, not technical vulnerabilities. Options A and C describe technical exploitation, while D is unrelated to phishing success.