Phishing is a social engineering attack that tricks users into performing actions like clicking malicious links, entering credentials, or downloading malware. The attack succeeds when users are deceived, not because of technical vulnerabilities in systems.