Phishing Protection

With more businesses functioning online, exposure to computers and the Internet has increased manifold. Thus, you have cybercriminals growing in number as well. Hackers are becoming more intelligent than before. However, phishing is still the top threat among all breaches analyzed over the past one year. Therefore, it has become imperative for business organizations to know about phishing and phishing protection methods to apply to prevent them.

We shall now talk about some of the common types of phishing and see how organizations can defend themselves against them.

Phishing Protection Service

Read More...

Deceptive Phishing

Characteristics of deceptive phishing:

  • Most prevalent among all types of phishing.
  • Emails appear to originate from a recognized sender.
  • Steals data by impersonating a genuine provider.

In this type of phishing, the cybercriminals impersonate a legitimate provider to steal personal information such as credit card details or login credentials of financial institutions. One example of such deceptive phishing is that of PayPal scammers.

Hackers send out emails to recipients to click on a link to ‘rectify specific discrepancy’ in their accounts. However, the link directs the recipients to a fake PayPal Login Page that the hacker uses to steal info. As a user, one should verify all the URLs carefully and look for spelling mistakes, grammatical errors, or generic salutations, and be vigilant to tackle such phishing attempts.

Spear Phishing

Characteristics of spear phishing:

  • Commonly observed on social media sites.
  • The email looks like it originates from a known sender.
  • Uses personalized info about the target.

As the name suggests, spear phishing is targeted-phishing. The hacker collects the target’s name, email id, organization details, work phone number, and other crucial information. The objective is to trick the target into believing that they have a connection with the sender. The hacker aims to trick the target into clicking on a spurious link or download a malicious attachment through which he/she attempts to steal personal information. One can observe such spear-phishing in social media sites like LinkedIn, where it is easy to collect information and craft a targeted attack email.

The best phishing protection methods to employ to guard against spear-phishing are:

  • Train your employees to identify phishing attempts
  • Be careful when sharing sensitive private information with people
  • An automated email-analyzing solution to identify such phishing emails is the best investment to make.

CEO Fraud

Characteristics of CEO Frauds:

  • It usually targets top-level executives.
  • The objective is to authorize fraudulent financial transactions.
  • Obtain crucial tax info on all employees.

The modus operandi of the cybercriminals is simple in this type of phishing attack. They try to get hold of the login details of a top enterprise executive. In doing so, the hackers impersonate the CEO or high-ranking official to authorize the financial transactions of the business organization. The criminals also use the same email account to request the taxation or W-2 information of all employees. This information has a high demand on the dark web.

Usually, you do not see high-ranking officials or CEOs participating in the employee phishing awareness programs. Hence, it becomes easy for hackers to target this exclusive group. Here are some phishing protection methods to counter such threats.

  • Ensure that the top-ranked executives take part in phishing awareness training programs so that they do not become vulnerable targets.
  • Make sure that the business organization adopts multi-level authentication for authorizing financial transactions.

Pharming

As a result of business organizations adopting phishing awareness programs and the like, the awareness levels of the employees are now high. Hence, it has become challenging for cybercriminals to choose the traditional phishing scams. Therefore, they resort to a new type of phishing known as pharming.

Characteristics of pharming:

  • Redirect the victim to a malicious website.
  • Change the IP address associated with a specific website.
  • Leverage cache-poisoning against DNS servers.

The Internet uses the Domain Name System to convert alphabetical websites to a numerical form to locate and direct visitors easily. The DNS cache poisoning attack entails the hacker targeting a DNS server and changes the IP address associated with the alphabetical name of the website. Thus, the cybercriminal redirects users to a malicious website of their choice. The problem with pharming is that the victim experiences the same issue even when he/she enters the correct site name instead of clicking on the link.

The phishing protection methods to handle pharming are:

  • Use only HTTPS-protected websites as far as possible.
  • Have an updated anti-virus software solution installed on your computer networks.
  • Ensure to update your security patches regularly.

We have discussed four innovative methods of phishing adopted by cybercriminals all over the world and examined the phishing protection methods that one should use to tackle such phishing attempts. Ultimately, it boils down to two aspects:

  • Have up to date security systems installed on your computers.
  • Increase your awareness levels and be vigilant at all times.

These are the most straightforward phishing protection methods you can employ at all times.


How Hackers can Phish You Without Stealing Your Credentials

How Hackers can Phish You Without Stealing Your Credentials

Most phishing attacks are pretty straight forward. You receive an email that convinces you to log into some website you’re familiar with. But, it’s just a convincing looking replica of the website and what you’re really doing is entering your credentials into a bogus site. Once you do that, the bad guys have your credentials, and depending on which ones, they can create a whole lot of havoc for you.

(more…)

After a Hiatus Phishing Emails Once Again Being Used to Deliver Ransomware

After a Hiatus Phishing Emails Once Again Being Used to Deliver Ransomware

For the longest time, the number one delivery mechanism for ransomware was a phishing email. As much as 91% of ransomware was delivered that way. And then things changed.

According to an article on ZDNet, “in recent years, attackers have successfully pivoted to using remote ports, insecure public-facing servers and other vulnerabilities in enterprise networks to encrypt entire networks – often demanding hundreds of thousands of dollars in payment to release the data again.”

(more…)

The Always Dangerous Combination Phishing Attack

The Always Dangerous Combination Phishing Attack

What’s more dangerous than a phishing attack that uses a social engineering tactic to get you to click? How about a phishing attack that uses a combination of TWO social engineering tactics to get you to click? And that’s exactly what was detected this week according to InfoSecurity Magazine.

In this case, the two social engineering tactics are phishers hiding COVID-19 malware in both CVs (curriculum vitae or resumes) AND medical leave forms. According to the article, “Cyber-criminals are taking advantage of the evolving jobs market and employee health situation under COVID-19 to disguise malware in various emailed documents. The phishing campaigns spotted center around spoofed CVs and medical leave forms.”

(more…)

If You Received an Email from the Supreme Court Would You be Suspicious?

If You Received an Email from the Supreme Court Would You be Suspicious?

I hope to never receive an email from the United States Supreme Court. It couldn’t possibly be good news. I would be very suspicious. But there is one small group of people who, if they received such an email, might not be suspicious: C-suite executives. And that’s exactly what some hackers thought as they targeted such individuals with a zero-day credential phishing attack impersonating the Supreme Court.

(more…)

As the World Moves to Virtual Live Entertainment Hackers Look to Take Advantage

As the World Moves to Virtual Live Entertainment Hackers Look to Take Advantage

One of the ways the world has responded to the COVID-19 pandemic is to take a lot of the entertainment we used to enjoy live and in person and move it online into the world of virtual entertainment. The entertainment is still live, but now instead of watching musicians in a bar or theater, you get to watch them live streamed on your smart TV or mobile phone. The hackers know this, and they are aiming to do something about it.

(more…)

It Was Only a Matter of Time Before the Lockdown Lead to Delivery-based Phishing Scams

It Was Only a Matter of Time Before the Lockdown Lead to Delivery-based Phishing Scams

The COVID-19 worldwide lockdown has had many side effects, not the least of which is that people are doing even more online shopping now. Weekly online purchases now include staples like food and cleaning products. Amazon’s sales since the pandemic arrived is up 35%. And what’s the one thing all these online sales have in common? A delivery service has to bring them to your door.

(more…)

The Biggest Beneficiaries of COVID-19 are also the Biggest Phishing Targets

The Biggest Beneficiaries of COVID-19 are also the Biggest Phishing Targets

Even when something as horrible as COVID-19 happens, there are some companies that benefit. One of the beneficiaries of the virus is Zoom Video, the video conferencing company that has seen a huge demand increase for their product.

Another, less obvious company, that has seen an increased demand for their service is Netflix. Recent stats display that as the COVID-19 crisis gripped nations throughout the world, Google searches for Netflix jumped to 142%. And sure enough, just as the demand goes up, so too do the number of phishing attacks targeting the company’s customers (and potential customers).

(more…)

A New Way Hackers Take Advantage of Web Pages to Phish You

A New Way Hackers Take Advantage of Web Pages to Phish You

You have to hand it to those hackers. If there’s a way to trick you with a phishing email, they’ll figure it out. One of the best ways hackers try to trick you with a phishing email is to take advantage of the way web pages are rendered.

Web pages use HTML (hypertext markup language) and CSS (cascading style sheets) to display web pages on your computer and your mobile phone. These technologies are well-understood and have been around for a long time. One of the things that makes these technologies so powerful is how flexible they are.

(more…)

The Strange Irony of COVID-19’s Effect on Certain Phishing Attacks

The Strange Irony of COVID-19’s Effect on Certain Phishing Attacks

While the pandemic known as COVID-19 is causing a dramatic increase in coronavirus-themed phishing attacks, it’s strangely having the opposite effect on other phishing attacks.

When it comes to phishing attacks, hackers tend to “specialize” in a certain type of phishing attack. And as things turn out, some of these “specialists” are really feeling the pinch from COVID-19. A lot of people are struggling in this economy, and apparently some of them are bad guys.

(more…)

Now We Know Why the Healthcare Industry is so Vulnerable to Ransomware

Now We Know Why the Healthcare Industry is so Vulnerable to Ransomware

If you’ve been paying any attention, you’ve seen that the healthcare industry is under a constant threat from phishing attacks that lead to ransomware. Every week it seems there’s another healthcare organization hit with a data breach or ransomware. The question is, why? And now we know the answer.

The short answer is, healthcare organizations are an easy target for hackers because their cyber defenses stink. So, the real question is, why do healthcare organizations cyber defenses stink? The short answer here is, it’s just not a priority for them. And apparently, the hackers know it.

(more…)

Two New Advanced Phishing Threats You Need to Know About

Two New Advanced Phishing Threats You Need to Know About

You have to hand it to those hackers, they’re always innovating. This week comes news of two new phishing exploits designed to do one thing: convince you it’s NOT a phishing email.

First, from Threat Post, comes a clever exploit that uses YouTube redirect links, which are whitelisted by many security defense mechanisms, to evade detection. From the article, “If certain malicious URLs are blocked by web browser phishing filters, attackers commonly use a redirector URL to bypass these filters and redirect the victim to their phishing landing page. URL redirects have been used in previous campaigns, including malicious redirect code affecting Joomla and WordPress websites and HTML redirectors being used by Evil Corp. Now, a new campaign is using legitimate YouTube redirect links.”

(more…)

No Matter How You Sign in These Attackers Have You Phished

No Matter How You Sign in These Attackers Have You Phished

Do you ever use an online service that gives you multiple ways to sign in? For example, there’s the online storage service Dropbox which lets you login with your Google credentials, Yahoo credentials, Office 365 credentials and others. Seems very convenient, because you don’t have to remember as many login credentials. Well guess what? Attackers know that and they’re now using it to phish you.

(more…)

The Phishing Numbers from 2019 are in and They Don’t Look Too Good

The Phishing Numbers from 2019 are in and They Don’t Look Too Good

Now that we’re in 2020, the phishing numbers from 2019 are starting to trickle in. Numbers which attempt to quantify the state of phishing, such as how many emails were malicious and how many were effective. And so far, things look pretty bleak.

For starters, what percentage of people do you think can spot all of the phishing scams out there? It’s important to spot them all because it only takes one click to bring down an entire organization. The answer? 5% according to a survey from Security.org.

(more…)

Pin It on Pinterest