Phishing attacks are soaring across the business landscape, increasing in frequency and severity as organizations continue to operate in remote or hybrid working environments. Both phishing and spear-phishing techniques are becoming more complex and sophisticated in an effort to deceive organizations’ prevention tactics and exploit employees. To maintain effective
anti-phishing programs, security teams must understand the types of phishing methods now targeting their organization’s employees.
This piece provides an overview of current trends in both phishing and spear-phishing to help identify attacks and build a tailored, comprehensive anti-phishing strategy.
Different Types of Phishing
Phishing and spear-phishing are categorized as social engineering attacks. They both aim to convince recipients to bypass established security measures and divulge sensitive information. Both phishing categories share similar techniques and are equally capable of causing serious harm to organizations and employees. The difference is that spear-phishing is far more targeted and likely to succeed.
Phishing is a broad term for casting a large net out to snare responses, usually with mass emails relying on volume to find victims. Phishing attackers often use spoofed emails, fake websites or other methods to persuade victims to reveal sensitive information, such as passwords, financial information and personal data, or to click on a link to unleash malware or ransomware. Other examples of current phishing scams include:
- Vishing: These phishing attacks happen via a phone call. For example, victims may receive a call with a voice message disguised as a communication from a financial institution. The message prompts them to enter their account information or PIN for security or other official purposes, but that sensitive info then gets funneled directly to the attacker via the corporate voice-over-IP service. Again, vishing attacks against businesses usually target a sizable number of employees.
- Smishing: Also known as SMS phishing, this type of attack uses misleading phone text messages designed to convince victims they come from a trusted colleague, manager or organization. The messages implore the victim to take immediate action, i.e., purchase gift cards, wire funds or forward financial information. Smishing works because people are more trusting and likely to respond to text messages than email. In addition, phones generally lack the type of security available to employees on laptops, leaving them vulnerable to malware attacks.
Spear-Phishing - Custom Email Attacks
Spear-phishing is a highly targeted, custom email attack designed to trick a specific high-value employee into clicking a malicious link or attachment, yielding higher rewards and extremely high success rates. Attackers have fine-tuned their techniques to pull personal information from numerous sources (such as social media) and use spoofed credible-appearing emails that seem to originate from managers, vendors or colleagues. Executives are often targeted, because the potential reward from a successful attack is greater, given the amount and level of sensitive data, network access or financial access they possess. Current spear-phishing methods include:
- Whaling: This targets senior executives with the authority to access confidential information, allow access into networks or approve a large money transfer.
- C-level attacks: Aimed at mid-management employees, these impersonate senior or other high-level colleagues and pressure individuals into taking unauthorized actions
- Business email compromise (BEC): These attacks, which include vendor and invoice fraud, use spoofed or hacked email addresses to lure in victims. Email accounts of senior executives or financial officers are compromised by exploiting an existing vulnerability, usually with a spear-phishing attack. Attackers will then monitor email activity to learn the organization’s internal processes and procedures. Next, a fake important and urgent email that appears to originate from the executive’s account is sent to a key employee. The email requests a wire transfer to an external bank account—the attacker’s bank account
READ: 10 Ways to Identify a Phishing Email
Anti-Phishing Phishing Programs
Recognizing different phishing methods and performing regular security risk assessments helps security teams build effective anti-phishing programs tailored to their organization. Humans are usually the weak links in phishing attacks. Therefore, organizations should offer consistent education, training and simulations to help employees and executive teams learn to recognize potential phishing attacks.
In tandem, organizations must keep both anti-phishing tools and risk mitigation plans updated. Ultimately, phishing is a game of human deception and it’s here to stay.
Although reasonable efforts will be made to ensure the completeness and accuracy of the information contained in our blog posts, no liability can be accepted by IANS or our Faculty members for the results of any actions taken by individuals or firms in connection with such information, opinions, or advice.