3 types of phishing attacks and how to prevent them

When ISACA just lately launched half 2 of its State of Cybersecurity 2020 report, it was famous that the biggest reported assault sort was social engineering. While social engineering isn’t new to the menace panorama, it’s an assault sort that has had endurance, and attackers have gotten more and more refined of their method. Let’s discover a number of totally different types of phishing-based social engineering attacks, in order that you do not take the bait — hook, line and sinker.

Different types of phishing attacks

Phishing, a high-profile kind of social engineering, is a high-tech rip-off that makes use of e mail or web sites to deceive targets into disclosing private info helpful in identification theft, passwords or different delicate info. Phishing can be an try to achieve entry to your company pc or community by requesting that you simply click on a hyperlink to obtain a doc or go to an internet site. Phishing jeopardizes the safety of your organization’s info and info methods.

There are two essential strategies of phishing attacks: e mail and tabnabbing. I’ll discover each types of methods to achieve unauthorized entry. However, first let me observe the totally different types of e mail phishing. Phishing is often an e mail despatched to a big group of people who makes an attempt to rip-off the recipients. Those recipients don’t usually have something in widespread. This tends to be a bit of simpler to spot and cease with the suitable spam filters.

Spear phishing

Spear phishing, nonetheless, is a message despatched to a smaller, extra choose group of focused folks or to a single particular person. Spear phishing typically targets a selected particular person or group of people, similar to center administration or management of a company. Another distinction is {that a} spear phishing e mail might seem to come from somebody inside your group, most certainly from somebody able of greater authority. Spear phishing is often carried out by very refined hackers who most certainly have completed reconnaissance about you and your company on social media websites similar to LinkedIn.

If the hackers reach gaining info from you, they will use that info to break into your company info methods. If these hackers achieve entry to these methods, they may maintain your group’s knowledge hostage till they obtain a ransom. They may even give you the chance to deliver down the community or get hold of delicate or company confidential info.

Whale phishing

Some attackers are much more bold and take their schemes proper to the highest. Whaling, or whale phishing, is a extremely personalised message despatched to senior executives or different high-level officers. (*3*) will be the most tough for the company spam filters to spot and block.

One widespread thread amongst phishing emails is an try to trick or scare the goal into an instantaneous response. The e mail or pop-up message often claims to be from a legitimate source, similar to your personal group. The message, or lure, often says that you simply want to replace or verify your account info. It may threaten some dire consequence if you don’t reply.


Now, let’s look carefully at one other methodology known as tabnabbing. Tabnabbing happens when an attacker takes management of your net browser. For instance, one afternoon, you might be working at your pc researching the CDC web site about reopening your office during COVID-19, whenever you notice that you simply want to examine every state for the totally different guidelines about opening up the workplace. After opening up a number of tabs in your browser to examine the totally different states, you progress to return to the CDC web site and your authentic analysis when the tab on your company e mail catches your eye. You examine to see in case you’ve obtained any new messages. It seems that you’ve got been logged out of your session, although you may’t actually bear in mind having your company e mail open earlier within the day.

You have a alternative to make. You can both sort your username and password and choose the login button, or shut the tab. Here’s how it really works. You are utilizing the web and have a number of tabs open at one time. The attacker notices you have not interacted with a tab for some time and replaces the content material on that web page with a familiar-looking web page — your e mail, for instance. The attacker even provides the suitable icon to the tab. The subsequent time you have a look at your open tabs, you could discover the e-mail tab and resolve to examine your e mail. If you sort in your username and password, the attacker copies that info to his or her server, then redirects you to the proper e mail server, and you have been a sufferer of phishing with out even realizing it.

Phishing as a malware vector

Phishing performs a big position in distributing malware straight onto person methods by deploying ransomware, cryptojackers and keyloggers. ISACA’s State of Cybersecurity 2020 examine famous that ransomware is the most-reported mechanism of post-exploitation monetization. However, subtler, extra superior adversaries can use this widespread method to do rather more. After stealing your credentials or injecting code into one other course of or pc, it could act as a “again door.” Hackers can then set up a persistent presence on the company community and conduct community reconnaissance at their leisure. The hackers might even bypass compromising any further endpoints and entry delicate paperwork saved in cloud-based providers.

With a sufficiently big focused phish, attackers may have entry to what you may have entry to in your company system — a chilling situation that finish customers and their organizations should vigilantly work to keep away from.

About the creator
Pamela Nigro, CISA, CRISC, CGEIT, CRMA, is an ISACA board director and vice chairman of info know-how and safety officer at Home Access Health Corporation. Nigro is skilled in governance, danger, compliance and cybersecurity specializing in the healthcare and insurance coverage industries. She is a acknowledged subject material knowledgeable in HIPAA, HITRUST, SOC 1, SOC 2, Sarbanes-Oxley (NAIC-MAR) and IT/cybersecurity controls and danger assessments. Nigro can be an adjunct professor at Lewis University, the place she teaches graduate-level programs on info safety, ethics, danger, IT governance and compliance and administration of info methods within the MSIS and MBA packages.


Related Posts