Data shows that phishing emails were the most common entry points for ransomware, leading to a 54% increase in online security vulnerabilities.
The figure is expected to increase in the coming years, with more and more companies, people, and organizations falling victim to phishing attacks.
The big question is, what can you do to protect your business and stay safe from online scams?
An effective strategy is to know the typical phishing attacks and how they work to learn to spot and prevent these scams from succeeding.
Continue reading to understand the four most common phishing attacks and how to protect your business from these threats.
1. Spear phishing
Spear phishing is a phishing scheme where attackers send seemingly “personalized” emails.
The messages can include the target’s name, company, position, contact details, and other personal information.
Doing so can trick the target into believing they know or have a connection with the sender.
The end goal is to get you or your employees to click a malicious email attachment or URL and unwittingly hand over sensitive information.
Spear phishing attacks are common on social media platforms such as LinkedIn. Attackers can leverage multiple data sources to create a targeted attack email.
The usual techniques used in spear phishing scams include the following:
- Compromise tokens. Some attackers try to compromise API tokens (or session tokens), allowing them to access an email account and other resources.
- House malicious files on cloud services. Fraudsters typically house malicious documents on Google Drive, Dropbox, and other cloud services.
Most IT departments are not likely to block these services, making them a great attack vector for cybercriminals.
Also, since the cloud services are not blocked, your company’s email filters will not likely flag the weaponized files.
- Gather information from social media. Cybercriminals can discover your company’s employees by exploring their social media profiles and your business’s internal structure.
Then, attackers can use the information to single out for their targeted phishing attacks.
Defend against spear phishing attacks with these tips.
- Conduct routine security awareness training for your employees. You can also create policies that prevent or discourage your employees from sharing personal or company information on social media networks.
- Invest in robust solutions that can analyze your inbound emails for common or known malicious email attachments and links. Opt for software that can pick up on known malware and zero-day threats indicators.
2. Deceptive phishing
Deceptive phishing is a common scam where attackers impersonate legitimate companies or people to steal someone’s login credentials or personal data.
The deceptive phishing emails usually include threats and a sense of urgency to get you to act quickly on what the fraudsters want.
The techniques involved in deceptive phishing can include the following.
- Shortened links and redirects. Attackers commonly use shortened URLs to deceive Secure Email Gateways (SEGs) and, in turn, not raise red flags with targets.
The attackers can also use “time bombing” to redirect you to phishing landing pages only after successfully delivering the email.
Once you hand over your credentials, the scam campaign redirects you to a real web page to make the process seem legitimate.
- Legitimate links. Some malicious actors include legitimate links in their phishing emails, so email filters can’t detect them.
For instance, a deceptive phishing email can include the contact of an organization that attackers might be using for spoofing.
- Minimal content. Cybercriminals can try to evade detection by including minimal content in phishing emails. For example, attack emails commonly include a single image that, once clicked, leads to a phishing website or landing page.
One of the effective protection measures against deceptive phishing is to teach your employees to inspect URLs carefully.
Doing so helps ensure your employees can spot when they are redirected to unknown or suspicious websites.
Also, look for other easy-to-miss factors, such as grammar mistakes, spelling errors, and generic salutations common in phishing emails.
3. Pharming
Pharming is a more sophisticated form of traditional phishing scams.
Instead of baiting targets, pharming uses cache poisoning against the Domain Name System (DNS).
DNS is a naming system used by the internet to convert alphabetical website names to numerical IP addresses.
Cache poisoning against the DNS allows attackers to locate and ultimately direct victims to any device and computer service the hackers want.
In a pharming attack, users who enter the correct website name in the address bar can still get redirected to a malicious website.
The attack lets malicious actors target a DNS server and modifies the IP addresses associated with the alphabetical website name.
Pharming attack techniques can include:
- Targeting the DNS server. Attackers can target a DNS server instead of an individual user’s computer. It can potentially compromise millions of URL requests from web users.
- Malicious email code. Cybercriminals can send emails with malicious code that can modify host files on your computer.
Then, the host files redirect all URLs to a website the attackers control to allow them to steal your information or install malware in your system.
You can mitigate the risks of pharming attacks with these tips:
- Encourage your employees to provide login credentials only on websites with HTTPS.
- Deploy anti-virus software on all your company devices. Also, run virus database updates regularly.
- Stay on top of your security upgrades from your trusted Internet Service Provider (ISP).
4. Smishing
Smishing leverages malicious text or SMS messages to deceive recipients into clicking dangerous links or giving personal details.
Smishing techniques malicious actors use can include the following.
- Provide links to forms intended to steal data. Malicious actors can use text messages and common phishing techniques to fool you into clicking malicious links.
Then, the campaign redirects you to a website designed to deceive you into handing over your personal information.
- Trigger a malicious app download. Attackers can use the malicious links within text messages to automatically trigger a download of malicious apps on your mobile device.
The downloaded apps can deploy ransomware or allow attackers to control your device remotely.
- Give instructions to contact tech support. Some attackers send out text messages that tell you to contact a phone number for customer support.
Then, the malicious actors will pose as legitimate customer service reps who trick you into sharing your personal data, such as credit card information, for “verification purposes.”
Protect your business against smishing attacks by enabling your mobile device’s spam message (and caller) detection features.
You can also research unknown phone numbers that send you text messages and call the company named in suspicious messages to verify its legitimacy.
Learn the top phishing scams to protect against them
Understand the common phishing attacks and how the scams work to set up defensive measures against these threats.
The more you learn about phishing attacks, the better you can prepare and equip your company and employees to help keep the scams from succeeding.
Start with the identified phishing attacks in this guide. Develop defensive strategies to keep your business and assets protected.
Cover Photo by Cup of Couple
