Yes, phishing attacks commonly occur on social media through direct messages, posts, and comments containing malicious links. Attackers exploit the trust users place in social connections to deliver phishing content outside of traditional email channels.