In connection with this year’s European Cybersecurity Month, we are introducing one of the most common cyberthreats this week – the scam called Phishing.
Phishing is a cybercrime in which criminals act like a reliable source online and tricks users into revealing personal confidential information such as passwords, credit card details or usernames. Phishing attacks are mainly operated through emails and the cybercriminals are using many different methods to accomplish their goals. Today´s attacks are becoming more and more sophisticated, and it is important to be aware of the ways in which they are operating.
Common forms of Phishing
Following, we will be introducing to you the most common forms of phishing attacks and what can be done to avoid them.
- E-mail phishing /Deception phishing
This is considered the most common type of phishing and refers to malicious mailing which will trick the receiver into either clicking on a malicious link or downloading a compromised asset.
- Spear Phishing
This methods targets a very specific group of people – employees within a certain company or organization and aims to obtain information, data and resources. These types of emails are often more personalized in order to make the victim believe that they have a relationship with the sender.
- Whaling attacks
These types of attacks are even more targeted, aiming at senior executives. Even if the end goal of whaling is the same as with other types of phishing attacks, the technique serves to be more fine-drawn. Tricks such as fake links and malicious URLs are seldom used in this type of attack.
Common forms of whaling are scams involving false tax returns. Tax forms are highly preferred by cybercriminals as they provide the scammer with useful information such as names, addresses, social security numbers and bank account information.
- Angler phishing
This is a relatively new type of attack, but already a common one. Angler phishing refers to the event where cybercriminals use social media to trick people. For example through fake URLs, cloned websites, posts, and tweets or instant messaging. These services can all be used to convince people to download malware or reveal sensitive information. Furthermore, cybercriminals can use information that people post on social media to create targeted attacks.
Advice on how to stay safe from phishing
Verification of suspicious messages significantly reduces risks. To reduce the risk imposed by e-mail phishing, it is important to check for misspelling and if the sender email has the wrong domain. Furthermore, installation of a cybersecurity solution will prevent access to malicious content delivered through such messages.
To prevent spear phishing it is important to be attentive. If, for example, your CEO is requesting that you buy vouchers on short notice (with your private account) and this is an unusual or strange request from your CEO – double check and make sure it is a legitimate request. Do not make any transactions or share information before verification.
What we do at cyan
One example for how we are working on the prevention of harm from phishing attacks is our research project “Brand Impersonation”. In this project we have developed a new procedure to detect misuses of well-known brands. This new research module allows us to actively search for phishing content that imitates well-known brands and identifies them within seconds of going live.
Thanks to this procedure, we have been able to check content on domains when SSL certificates are issued. We have checked 3 billion certificates so far, whereby we have saved 1 billion domains for closer examination or later (re)checking. Every day we analyze more than 200.000 websites in detail. This makes us able to identify hundreds of threats in near real time and protect our customers from attacks.