What Different Phishing Attacks Can Look Like

[et_pb_section fb_built=”1″ _builder_version=”4.11.4″ _module_preset=”default”][et_pb_row _builder_version=”4.11.4″ _module_preset=”default”][et_pb_column _builder_version=”4.11.4″ _module_preset=”default” type=”4_4″][et_pb_text _builder_version=”4.11.4″ _module_preset=”default” hover_enabled=”0″ sticky_enabled=”0″]

If you’re unfamiliar with phishing, this cyber security threat is one of the top ways hackers can gain access to your company’s data and information.

 

Phishing attacks happen when a cybercriminal sends an email or message that may look inconspicuous, enticing a user to click a malicious link, download a malicious file, or provide sensitive information. Attackers disguise themselves as a trusted contact, leading the user to let their guard down.

 

Common examples include emails from your organization stating you need to change your password or even an email from your bank informing you that your account has been hacked. Urgent emails such as these prompt users to take action right away.

 

Unfortunately, phishing is a cyber threat that has only continued to grow over the past few years. On top of this growth, phishing has also become an even more prevalent threat due to the COVID-19 pandemic. 

 

COVID-related phishing campaigns have added a new element to these attacks. For example, hackers will send COVID-19 related information to users under the guise of a trusted organization, leading employees to click on unsafe links and give cybercriminals access to their network.

 

Though these types of emails are some of the most common forms of phishing, there are a variety of other tactics to keep an eye out for when looking to protect your business from cyber criminals. The next time you open your computer, watch for these scams.

Deceptive/Email Phishing

 

The most common type of phishing, this kind of attack is similar to the examples described above. Hackers impersonate a legitimate organization in order to steal a user’s data and information.

 

These emails and messages convey a sense of urgency and importance in order to get people to take action. They may include a malicious link or download that users make the mistake of clicking on. This then leads to malware being installed on their device or important credentials being stolen.

 

To spot deceptive phishing, take a look at the address the message came from. Chances are, if it uses a variety of letters and numbers and doesn’t come from a real website, it’s a phishing scam.

 

Spear Phishing

 

Spear phishing is another common type of phishing, but it’s a bit more complex than deceptive phishing. Cyber criminals who try spear phishing already have specific information about a person on hand. This might be their name, job title, or details about their job responsibilities.

 

Hackers might access this information on social media or on a company’s website. However, it makes their scams look more legitimate, as they have information that’s specific to one person. They often target people inside certain organizations, disguising themself as another employee that works in said organization. Many users see this as an internal request, prompting them to open the message and take action.

 

When looking for spear phishing attempts, keep an eye out for strange requests, shared links on platforms such as Dropbox or Google Drive, and password-protected documents.

 

Whaling

 

Even more targeted than spear phishing attacks, whaling attempts to target senior executives. Cyber criminals try impersonating CEOs or those in top leadership roles to ask their employees for things such as money transfers or the sharing of an important password.

 

These high-level employees often have access to more data than those working in lower levels of the company, which is why hackers will use their status to gain information.

 

They might increase the sense of urgency in their messaging, suggesting the company might be sued or legal action will be taken should their request be denied.

 

If you receive an abnormal request in your email, chances are, it could be a whaling attack. Be sure to check the address that came along with the message as well, as this will always be a key indicator of a cyber criminal. 

 

Vishing

 

This form of phishing involves an actual telephone call being made, where a cyber criminal will impersonate some sort of investigator or customer service representative. The criminal will then ask the user to provide their payment information or credit card details to “verify” their identity.

 

These hackers often rely on that sense of urgency that prompts individuals to take action right away. If you receive a call from an unknown or blocked number, it’s best not to answer.

 

Or, if you’re on a call and you’re not exactly sure who you’re speaking with, do not give them any confidential information. Many cyber criminals will call during tax season, convincing people they work for the IRS and need specific credentials from them for their taxes.

 

Smishing

 

Similar to vishing, smishing involves sending text messages that prompt a user to take action. These text messages often include malicious links that can install malware on a user’s device.

 

Some texts even contain a number for a user to call should they be in need of some kind of customer support. When this number is called, a hacker might attempt to trick the user into sharing their private information. This leads a user right into a vishing attack.

 

Take a look at the area code that accompanies any texts you receive. If it’s a number you don’t recognize and a request is made, there’s a good chance it’s from a cyber criminal. 

 

Watering Hole Phishing

 

Watering hole attacks involve attackers making note of the specific websites your employees frequently visit and infecting these sites with malware. Since your team members are likely to visit these websites, it makes it even easier for cyber criminals to access your network, servers, and information once they do.

 

Malware is installed onto the systems of your employees who visit these websites, allowing hackers to collect sensitive data. This malware can be spread to dozens of devices at one time, as multiple employees may be visiting the same sites.

 

Pharming

 

This form of phishing is tough to detect, as it involves hackers hijacking a Domain Name Server (DNS), redirecting users to malicious websites. DNS servers are used to direct website requests to IP addresses, but pharming attacks will instead take users to sites with fake IP addresses.

 

Your personal data and information is at risk when you end up on a website with a hacked DNS server. You’ll want to look for websites that are HTTP, not HTTPS when it comes to pharming. Take note of any strange inconsistencies you notice on the website as well, including misspelled words and strange fonts.

 

Angler Phishing

 

Social media has become a large factor in data breaches, as hackers now target users on platforms such as Facebook, Twitter, and Instagram. Sharing fake URLs in messages or malicious posts can trick users into sharing sensitive information or downloading malware directly to their device.

 

Cyber criminals can also use the personal information that people share directly on their social media pages to create targeted attacks.

 

If you get a notification about being added to a post, be careful of links that might be included. On top of that, don’t open any direct messages from a user you don’t know. If the message is coming from a friend, make note of the language used in case they’ve been hacked.

 

Pop-up Phishing

 

Pop-up blockers are more common these days, but pop-up phishing is still a common technique when it comes to stealing data.

 

Cyber criminals can insert malicious code into the pop-up boxes you see when you first visit a website. A message you might often see involves something along the lines of, “Itechra wants to show notifications.” Once you click “Allow,” this pop-up can install malware onto your device.

 

Before approving these notifications, check for spelling errors or strange looking websites.

 

Clone Phishing

 

Hackers who attempt clone phishing often recreate emails from companies they know users frequently receive communications from. For example, if you regularly receive emails from Apple, cyber criminals may impersonate these accounts and send you messages full of malicious links and attachments.

 

Attackers will typically state that they’ve sent you another message because the links or attachments from the previous message were incorrect.

 

Many users are used to seeing these names pop up in their inbox, so they’re less likely to question the content they receive. That’s why it’s always crucial to pay attention to the email addresses, content, and attachments you see in your inbox.

 

Evil Twin Phishing

 

This type of phishing involves hackers using fake WiFi hotspots, disguising them as a legitimate source of WiFi, and stealing information from those who use the connection. 

 

Most often, when users connect to the WiFi, cyber criminals will lure them to a phishing site. Once they’re on the site, they’re then asked to share personal login credentials or data.

 

Avoid using any hotspot that’s labeled as “unsecure.” Also, if you typically use hotspots that do not require login details, but are suddenly prompted to provide yours, avoid using that particular network.

 

Protect Yourself From Phishing Attacks

 

Taking measures to protect yourself and your business from phishing attacks is a smart move to make. Keep these things in mind and make sure your IT service provider has these measures in place as a part of your cyber security plan.

 

1. Train your team. Each member of your organization should understand the common traits of phishing scams and how they can avoid them through regular cyber security trainings.
2. Use spam filters in your email. Should an email end up in your spam folder, be sure it’s not a phishing scam before moving it to your inbox.
3. Backup your data. If you become a victim of a phishing scam, backing up your data will save you time when trying to gain access to your accounts after they’ve been hacked.
4. Use multi-factor authentication (MFA). We detail the benefits of MFA here.
5. Run antivirus software on all of your devices. Your IT service provider should be able to help you find a software that will keep you well-protected from any cyber threats.
6. Always update your software. You should be using the latest software updates on your devices, as the new changes often come with increased security measures.
7. Turn on website alerts in your browsers. This way, you’ll be notified should your computer detect anything out of the ordinary when you visit a website.
8. Regularly check on your accounts. This is especially important for your financial accounts. Should anything seem suspicious or change suddenly, you’ll know to take action immediately.
9. Never give out your personal information. Be very careful with who you share this information with as well as where you share it.
10. Change your passwords regularly. Your passwords should all be different. If you struggle to come up with new passwords, use a password randomization tool. Then, use a password manager such as LastPass to keep track of these passwords for you.

 

If you have any questions about the phishing attacks detailed above, or ways in which you can step up your cyber security measures, send us a message today. Our experts will walk you through these attacks and make sure your organization is protected!

[/et_pb_text][/et_pb_column][/et_pb_row][/et_pb_section]