Table of Contents
You share personal information with that platform whenever you create an online account. Cybercriminals take advantage of this with phishing attacks. They send emails pretending to be known contacts or organizations and ask for private information. Employees must be trained to spot phishing emails and report them to corporate security teams.
Spear Phishing
In a spear phishing attack, cyber criminals gather personal information over the Internet from social media and public records to make their emails appear familiar. Using the targets’ names, addresses, and other details, attackers send an email requesting sensitive data such as passwords, account information or credit card numbers. The attacks include links or attachments that install malware or ransomware on the victim’s systems. When victims click on these links or download attached files, their computers become compromised, and attackers can access company or client data.
Spear phishers often target executives or other high-ranking employees. They may pretend to be the CEO or CFO of a company or the head of a specific department or division. For example, financial teams are often targeted during tax preparation season with emails claiming to need W2 paperwork reviewed.
When an employee clicks on a link or opens an attachment, malicious payloads are delivered to the computer via innocuous-looking file attachments or malicious web pages that resemble real company intranet portals. Once a phisher has gained an entry point to the system, they can use it to steal company data, fraudulently wire money or even encrypt and hold information hostage.
Identifying spear phishing can be difficult, especially when crafted with great detail. However, an employee’s gut instinct is that something about an email is suspicious. In that case, they should always check the email’s legitimacy by verifying the claims directly with their employer or a trusted source and reporting any suspicious attachments or links to the IT team.
Deceptive Phishing
Deceptive phishing emails often look very convincing and seem like they are from a legitimate source. These emails use fear and urgency to entice the recipient into clicking a link or attachment that then downloads malware on their computer. The malware is designed to steal the victim’s login credentials or other sensitive information.
These phishing emails may also include a fake website or a link to a phony login page. Cybercriminals will usually gain access to the victim’s account credentials or download keylogging software to record the user as they type passwords and other sensitive information. Another type of deceptive phishing is voice phishing, which uses telephones and Voice over IP (VoIP) services to trick the victims into calling the scammer back. In these attacks, the phisher will offer technical support for a Windows machine, for example, and then access the victim’s machine and steal data.
Cybercriminals can also use publicly available resources, such as social media, to gather information about a potential target to make the phishing attack more convincing. This is known as OSINT or open-source intelligence.
To help keep employees safe, companies can deploy spam filters and other security software that automatically flag suspicious links or files. Educating employees to be cautious of links and attachments that come from unknown sources is crucial. Also, if an employee receives a questionable email, they should contact the IT department or provider directly to get a second opinion before clicking any links.
Evil Twin Phishing
This attack uses a fake wifi network to steal data from victims. Hackers can use this to spy on their victims, including tracking keystrokes and monitoring what websites they visit. They can also use fake wifi to send phishing emails or download malware to the victim’s computer. This phishing attack typically requires the user to connect to a phony network, so looking for red flags such as an unusual wifi name or two similar networks in the same location is important.
The most common way to protect against this attack is to ensure you never use public wifi to log in to private accounts such as Internet banking, email, or social media. It would help if you only used public wifi for web surfing, maps, directions, and other non-sensitive tasks like checking the weather.
Another red flag for this attack is a message that appears when you connect to a new network asking for personal information or login credentials. Legitimate networks will not prompt you for this, and any request should raise suspicions. Similarly, an urgent message about missing payments or renewals should signify a phishing attempt. If you receive a communication like this, contact the individual directly through other channels for verification. It would help if you also avoided downloading attachments unless you are 100 percent certain that the file came from a trusted source.
Whaling
A whale phishing attack targets high-level executives, typically impersonating a company’s CEO or senior leadership member. Cybercriminals can use publicly available information like social media profiles, corporate websites and press releases to gather details on the targeted executive to make their phishing emails appear more legitimate.
A whale phishing attack aims to convince the victim to transfer a significant sum of money or share sensitive information with cyber criminals. Because executives often have greater decision-making authority and access to critical business data, they can be easier targets than other employees.
Personalized messages: Fraudsters can often gather information about their targets through public sources, such as birthdays and hometowns, social media profiles, job promotions and relationships. Using this data, fraudsters can customize their emails with personal information to gain the victim’s trust and increase the likelihood that the request will be followed through.
Urgent language: Cybercriminals may use phrases such as “time is running out” or “must be completed in the next 30 minutes” to add urgency to their requests and make them seem more legitimate.
To avoid falling victim to whaling attacks, all staff should be educated about the types of phishing scams and how to spot them. Regular cybersecurity awareness training should encourage employees always to check the domain name in an email address, confirm suspicious requests over the phone or face-to-face and never click links provided in direct messages. It’s also important for employees to keep their social media accounts private and limit visibility to only friends or connections to prevent cybercriminals from gaining access to their personal information.
