Phishing is a social engineering attack where attackers pose as trustworthy entities (banks, companies, colleagues) to acquire sensitive information like passwords, credit card details, or personal data. It typically involves fraudulent emails or websites that appear legitimate but are designed to deceive victims into revealing confidential information.