Phishing is a social engineering attack where attackers disguise themselves as trustworthy entities to steal sensitive information like passwords or credit card details. It typically involves fraudulent emails or websites that appear legitimate. The key is the deception of posing as something the victim trusts.