What Is Pharming? How It Works and How Organizations Can Reduce Risk

For organizations, pharming can damage customer trust, expose users to credential theft, and increase incident response pressure. It is especially dangerous when combined with phishing emails, domain spoofing, or lookalike domains that make fraudulent campaigns appear legitimate.

This guide covers how pharming works, how it differs from phishing, the warning signs to watch for, and the controls organizations can use to reduce risk.

In September 2021, over 50 financial companies were victims of a sophisticated pharming attack that targeted online customers in the US, Europe, and APAC region. Nearly 1,000 devices per day were infected for three days before the pharming malware was recognized and shut down.

What Is a Pharming Attack?

A pharming attack manipulates the way a browser resolves a domain name. Instead of sending users to the legitimate IP address for a website, the attacker redirects them to a fraudulent site controlled by the attacker.

This can happen through DNS cache poisoning, compromised router settings, malicious browser configuration, or malware that modifies local host files. The goal is usually to steal credentials, payment information, personal data, or session details.

Because the fraudulent clone of a website can appear nearly indistinguishable from the real one, users may unknowingly submit sensitive information, including financial details, social security numbers, medical records, phone numbers, and email addresses. Once attackers obtain this data, they can conduct financial fraud, identity theft, and further cybercrimes.

Pharming is a combination of two words: phishing and farming. Attackers phish for a victim and farm for their data by intercepting information submitted to a spoofed site.

How Does a Pharming Attack Work?

Security teams that understand the attack sequence can spot exposure points earlier and apply the right controls at each stage. Here’s how a typical pharming attack unfolds:

1. Step 1 – Target selection: The attacker identifies a target website, typically a banking portal, e-commerce platform, or enterprise login page, and creates a fraudulent replica.
2. Step 2 – DNS or host file manipulation: The attacker corrupts the DNS cache on a server or installs malware that overwrites the host file on a user’s device, mapping the legitimate domain to a malicious IP address.
3. Step 3 – User navigates to the site: The user types a legitimate URL into their browser, believing they are visiting the real website.
4. Step 4 – Browser resolves to a malicious IP: Because the DNS mapping has been altered, the browser is silently directed to the attacker’s fraudulent server instead of the legitimate one.
5. Step 5 – User lands on a spoofed site: The fake site looks identical to the real one. The URL in the browser may appear correct, leaving the user with no obvious indication of compromise.
6. Step 6 – Credential and data theft: The user submits login credentials, payment details, or other sensitive information directly to the attacker’s server. The attacker can then use this data for financial fraud, identity theft, or further attacks.

Pharming Attack vs Phishing: What Is the Difference?

Pharming and phishing are related, but they are not the same. Phishing usually relies on deceptive emails, messages, or links that trick users into visiting a malicious site. Pharming manipulates DNS or local device settings so users are redirected to a fraudulent site, sometimes even when they enter the correct URL.

In real-world attacks, the two techniques may appear together. A spoofed email can direct users to a fake login page, while DNS manipulation or lookalike domains make the campaign harder to detect. This is why organizations need both user-awareness controls and technical defenses such as email authentication, DNS monitoring, and endpoint protection.

Pharming vs Phishing vs Spoofing: Comparison Table

Types of Pharming Attacks and Real-World Examples

Pharming attacks work by altering the way a browser resolves a web address, sending users to the wrong IP address so they land on a replicated website. There are several distinct types, each targeting a different layer of the network stack, and real-world incidents show how quickly each one can scale.

Local/host-based pharming happens when malware overwrites the host file on a single device, redirecting specific web addresses to a malicious IP address. Detection is difficult since only that device is affected, so endpoint protection and host-file monitoring are the primary defenses.

The DNSChanger malware campaign is one of the largest examples of this attack type at scale:

• Method: The DNSChanger malware campaign modified DNS settings directly on infected devices, routing traffic through rogue DNS servers controlled by attackers.
• Target: Over 4 million devices worldwide, spanning both consumer and enterprise networks.
• Impact: Victims were silently redirected to fraudulent sites, enabling advertising fraud and credential theft, until the FBI seized the rogue servers in 2011.
• Lesson: Router and DNS settings should be audited regularly, and organizations must monitor for unauthorized DNS changes across their environments.

DNS cache poisoning occurs when attackers corrupt a DNS resolver’s cache with false records, misdirecting every user who queries it. This is very difficult to detect since the compromise sits upstream of the victim’s device. DNSSEC and secure DNS resolvers (DoH/DoT) are the strongest defenses.

Router DNS hijacking happens when attackers exploit routers with default or weak admin credentials to change DNS settings, redirecting every device on the network at once. This is a common tactic against poorly secured consumer routers:

• Method: Attackers exploited routers with default or weak admin credentials to change DNS settings for entire networks.
• Target: Home users and small businesses relying on consumer-grade routers.
• Impact: All devices on the affected network were redirected to fraudulent sites without any visible warning.
• Lesson: Default router credentials must be changed immediately upon deployment. Firmware should be kept current, and DNS settings should be locked to trusted resolvers.

DNS server compromise happens when attackers target a DNS server directly, rerouting users without needing malware on individual devices. A single compromised server can redirect thousands of users at once, making this the technique most favored for large-scale credential theft against financial institutions and enterprise platforms. DNSSEC, DNS monitoring, and strict access control are the key defenses.

Malware-based pharming is delivered through email links or attachments; the malware overwrites host files so infected devices load a malicious site whenever a specific address is entered. It’s difficult to remediate because anti-malware scanning alone is often insufficient; a deep endpoint clean is typically required. The 2021 attack on the financial sector shows how far this technique can scale:

• Method: A malware-based pharming campaign targeted end-user devices across the US, Europe, and APAC in September 2021.
• Target: Online banking customers of over 50 financial institutions.
• Impact: Nearly 1,000 devices were infected per day over three days before the malware was identified and shut down.
• Lesson: Even well-resourced financial institutions can be affected at scale. Endpoint detection and DNS monitoring are critical early-warning controls.

What Are the Risks of a Pharming Attack?

Pharming carries serious consequences for both individuals and organizations, and the severity varies depending on what’s compromised.

Signs of a Pharming Attack

Security teams and users should watch for the following indicators. Signs are grouped by category for faster triage:

Browser and Network Signs

• Unexpected SSL certificate warnings or mismatches on sites that previously loaded without errors.
• Changes in browser homepage settings that were not made by the user.
• Frequent pop-ups redirecting to unfamiliar sites.
• DNS settings on the device or router have changed without authorization.
• The resolved IP address for a trusted domain does not match the expected value.

Account and Financial Signs

• Financial activities that users do not recognize, for example, credit card transactions or bank transfers.
• Replies to emails not initiated by the user or organization.
• Unusual or unrecognized activities on social media or corporate accounts.

Device Signs

• Deactivated antivirus, anti-malware, or other security software.
• New software installed on devices without user knowledge.
• Systems crashing or hanging frequently; pharming malware can consume significant resources.
• Devices showing unusual messages or programs upon startup.

How to Prevent Pharming Attacks

Reducing pharming risk requires layered security. No single control can stop every redirection-based attack, but the following measures reduce exposure across DNS, endpoints, users, and email.

For Individuals

1. Change default router credentials and apply firmware updates promptly.
2. Use a trusted DNS resolver. Public resolvers such as those offering DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) add an additional layer of verification.
3. Verify SSL certificate details when a login page looks unfamiliar. HTTPS encrypts traffic between the browser and the server, but it does not confirm the site itself is legitimate. Check the certificate issuer and domain carefully.
4. Enable multi-factor authentication (MFA) on all important accounts. Even if credentials are captured by a spoofed site, MFA reduces the risk of unauthorized access.
5. Keep anti-malware and endpoint protection software updated. Run regular scans to detect host-file modifications.
6. Avoid clicking links in unsolicited emails or messages. Follow links from known and trusted sources only. Otherwise, users may be redirected to cloned websites designed to capture credentials or payment information. Attackers sometimes disguise malicious destinations using branded short URLs, so verify the underlying domain before clicking, even if the link looks legitimate.
7. Be skeptical of offers such as heavy discounts, lotteries, or prizes that arrive unsolicited. These are common baits used to draw users toward fraudulent sites.
8. Where possible, use app-based or QR code-based authentication instead of SMS one-time passwords, which can be intercepted or redirected as part of a broader attack.

For Organizations

Secure DNS Infrastructure

Use a reputable DNS provider, restrict access to DNS management consoles, monitor DNS record changes, and implement DNSSEC where appropriate. DNSSEC adds cryptographic signatures to DNS records, helping prevent cache poisoning attacks.

Protect Endpoints and Browsers

Keep operating systems, browsers, endpoint protection, and anti-malware tools updated. Malware-based pharming often relies on modifying local settings or host files on employee devices.

Strengthen Router and Network Security

Change default router credentials across all network infrastructure, apply firmware updates, and restrict administrative access to trusted users and networks. Audit DNS settings on routers regularly.

Use Email Authentication to Reduce Spoofing Risk

SPF, DKIM, and DMARC help receiving mail servers verify whether a message claiming to come from your domain is authorized. When properly configured and monitored, these protocols reduce the risk of domain spoofing and help prevent attackers from using your brand in email campaigns that lead users to fraudulent websites.

Email authentication works alongside DNS security, endpoint protection, and secure browsing controls, not in place of them. Its role is narrower: stopping spoofed messages that attackers use to launch pharming or phishing campaigns.

Monitor Lookalike Domains and Suspicious Infrastructure

Attackers often register domains that closely resemble trusted brands. Use a lookalike domain checker to detect impersonation attempts earlier and prevent them from being used in pharming or phishing campaigns.

Train Users and Employees to Report Suspicious Redirects

Employees and customers should know how to report unusual login pages, unexpected redirects, SSL certificate warnings, and suspicious emails. Establish clear reporting workflows so security teams can respond quickly.

Verify Your Domain Security Posture

Use PowerDMARC’s Domain Analyzer and DNSSEC Checker to audit your domain’s authentication posture and identify gaps before attackers exploit them.

How PowerDMARC Supports Domain Protection

PowerDMARC helps organizations strengthen the email-authentication layer of domain security. The platform provides a centralized dashboard for DMARC, SPF, DKIM, BIMI, MTA-STS, and TLS-RPT, giving security teams clear visibility into authorized and unauthorized sending sources.

• DMARC monitoring and reporting: Identify spoofing attempts, authentication failures, and unauthorized senders across all your domains.
• Automated SPF management: Avoid SPF lookup-limit issues as new SaaS and marketing platforms are added to your sending stack.
• Hosted authentication services: Manage DMARC, SPF, DKIM, BIMI, MTA-STS, and TLS-RPT from one platform without complex DNS changes.
• Compliance support: Maintain alignment with Google, Microsoft, PCI DSS, GDPR, and government email authentication mandates.
• Responsive global support: Get expert help during onboarding, troubleshooting, and enforcement planning, with 24/7 coverage for enterprise and MSP partners.

Want to check whether your domain is protected against email spoofing? Scan your domain for DMARC, SPF, and DKIM issues using PowerDMARC’s free Domain Analyzer.

Frequently Asked Questions

How is pharming different from phishing and spoofing?

Phishing relies on deceptive emails, messages, or links that trick users into visiting a malicious site with a different URL. Spoofing is the impersonation of a person, domain, email address, or website. Pharming is distinct from both: it manipulates DNS or local device settings to redirect users to a fraudulent site, sometimes even when they type the correct URL, without requiring any link click. In practice, attackers often combine all three, spoofing a trusted brand’s email to launch a campaign, then using pharming to ensure redirection even for users who navigate directly.

What are some famous pharming attacks?

Notable examples include the 2021 attack on 50+ financial institutions that infected nearly 1,000 devices per day, the DNSChanger malware campaign that affected over 4 million devices globally, and widespread router DNS hijacking campaigns that redirected entire home or office networks. See the Types of Pharming Attacks and Real-World Examples section above for detailed case summaries.

Can a pharming attack happen even if the URL looks correct?

Yes. This is what makes pharming particularly dangerous. In DNS-level pharming, the attacker manipulates the domain-to-IP mapping so the browser is directed to a fraudulent server while the URL in the address bar still appears correct. Users cannot rely on URL inspection alone to detect pharming.

How can businesses prevent pharming attacks?

Organizations should implement DNSSEC, use secure DNS resolvers, harden routers and network devices, deploy endpoint protection, monitor DNS record changes, enforce multi-factor authentication, implement email authentication (SPF, DKIM, DMARC), monitor for lookalike domains, and train employees to report suspicious redirects. A layered approach is essential because no single control covers all pharming vectors.

Can DMARC prevent pharming?

DMARC does not directly prevent DNS poisoning or host-file manipulation. However, it helps stop attackers from spoofing your domain in email campaigns that may direct users to fraudulent websites. Combined with DNS security and endpoint controls, DMARC is an important part of a layered defense strategy.

What should I do if I suspect a pharming attack?

If you suspect pharming: (1) Check your device’s DNS settings and router DNS configuration for unauthorized changes. (2) Clear your DNS cache and restart the browser. (3) Run a full endpoint malware scan. (4) Change passwords for any accounts accessed during the suspected period. (5) Contact your bank or affected service providers immediately. (6) For organizations, escalate to your incident response team and review DNS monitoring logs.

• About
• Latest Posts

Ahona Rudra

Domain & Email Security Expert at PowerDMARC

Ahona is the Marketing Manager at PowerDMARC, with 5+ years of experience in writing about cybersecurity topics, specializing in domain and email security. Ahona holds a post-graduation degree in Journalism and Communications, solidifying her career in the security sector since 2019.

Latest posts by Ahona Rudra (see all)

• What Happens When AI Chatbots Leak Internal Business Data? - August 21, 2026
• PowerDMARC Integrates with Autotask Natively - August 18, 2026
• SSL vs TLS Protocols: What’s the Difference? - August 13, 2026