Phishing attacks against construction firms and their supply chains are one of the most common types of cyber-attacks for the industry.