What is Phishing attack and how to prevent it?

Phishing messages manipulate a user, causing them to perform actions like installing a malicious file, clicking a malicious link, or divulging sensitive information such as access credentials. Phishing is the most common type of social engineering, which is a general term describing attempts to manipulate or trick computer users. Social engineering is an increasingly common threat vector used in almost all security incidents. Social engineering attacks, like phishing, are often combined with other threats, such as malware, code injection, and network attacks. In other words, phishing is a type of social engineering attack often used to steal user data, including login credentials and credit card numbers. It occurs when an attacker, masquerading as a trusted entity, dupes a victim into opening an email, instant message, or text message. The recipient is then tricked into clicking a malicious link, which can lead to the installation of malware, the freezing of the system as part of a ransomware attack or the revealing of sensitive information. An attack can have devastating results. For individuals, this includes unauthorized purchases, the stealing of funds, or identifies theft. Moreover, phishing is often used to gain a foothold in corporate or governmental networks as a part of a larger attack, such as an advanced persistent threat (APT) event. In this latter scenario, employees are compromised in order to bypass security perimeters, distribute malware inside a closed environment, or gain privileged access to secured data. An organization succumbing to such an attack typically sustains severe financial losses in addition to declining market share, reputation, and consumer trust. Depending on scope, a phishing attempt might escalate into a security incident from which a business will have a difficult time recovering.

How Do Phishing Attacks Work?

Target Research and Content Crafting: The crux of a phishing attack is getting the email recipient to believe the phishing message. To do this, attackers need to craft email content that is relevant or interesting to the recipient. Also, it must be consistent with the tone, language, and style of the organization or person they are pretending to be. A conscientious attacker will spend lots of time on research. For mass phishing campaigns, attackers often impersonate famous brands like DHL, Amazon, and Google. In fact, LinkedIn is reported to be the most impersonated brand in phishing attacks in Q1 2022. For specific organizations, attackers tend to do in-depth research. They then search for employees' email addresses on the company’s website or social media to send phishing emails.

Once the victim is tricked, the attacker can proceed to the next stage of achieving their objectives.

Objective 1: Information Theft: Some phishing emails are designed to steal personal information. These emails pretend to be from trusted sources such as well-known enterprises and government departments. They create an excuse to make the recipient provide their personal data. The scammers can sell this information or use it for their own gain. This includes applying for credit cards in the victim’s name, applying for a tax refund, and making insurance claims.

Objective 2: Financial Fraud: Some phishing emails instruct recipients to transfer funds to an account. These emails often purport to be from a trusted sender, such as a boss or a well-known organization. They present a situation that requires immediate attention to create a sense of urgency. Victims may be left too anxious to check the credibility of the email and end up making the transfer. In a new public service announcement, the FBI's IC3 reported that business email compromise (BEC) scams cost companies around the world $43 billion between June 2016 and August 2022.

Objective 3: Network Intrusion: A phishing attack can be used to breach enterprise networks to achieve bigger objectives, such as ransomware infection and data theft. In fact, phishing attacks are one of the most common ways threat actors gain initial access to enterprise networks. According to the Cisco 2021 Cybersecurity Threat Trends report, 90% of data breaches involve phishing.

Phishing attacks achieve network infiltration in two main ways.

·         Phishing links: Most phishing emails contain a link that takes the recipient to a web page controlled by the attacker. This web page may directly download malware onto the victim’s machine. The web page may be a fake login portal for a commonly used business service. Attackers can use these phishing sites to record the victim’s input data to steal their username and password. This allows the attacker to gain network access by logging in as a trusted user. Statista detected a total of 611,877 phishing sites worldwide in Q1 2021, up from 165,722 in Q1 2020.

·         Phishing attachments: Some phishing emails are attached with malicious files. These files can be disguised using unsuspicious file names. They can also be legitimate file types like Word and Excel files that have been tampered with. For example, attackers can embed a macro function in Office files to run programs and connect to the internet when opened. The macro function can also act as a loader to download and execute another malware payload. Other common phishing attachments include .exe, .zip, .rar, .pdf, and .iso files.

After loading their malicious files and tools onto the victim's machine, attackers can use more sophisticated techniques to escalate the attack.

Types of Phishing Attacks

Phishing attacks can be carried out in a number of different ways.

·         Phishing Campaign: In a phishing campaign, attackers send emails to thousands and millions of users. These messages are relevant or of interest to a broad audience. For example, emails that inform users of suspicious activity on their accounts and ask them to change their password. These phishing attacks aim to steal credentials or other confidential information. For example, phone numbers, account numbers, social security numbers, and credit card details.

·         Spear Phishing Attack: Spear phishing is a targeted form of phishing attack against specific individuals, organizations, or industries. Attackers typically conduct in-depth research on their targets to craft phishing messages that are highly realistic and relevant. According to Symantec’s Internet Security Threat Report 2019, 65% of threat actors used spear phishing as the primary attack vector.

·         Internal Spear Phishing Attack: Internal spear phishing attack occurs when an internal user’s email account is hacked. It is then used to send spear phishing emails to contacts within the organization or third parties. The use of a trusted email account to launch spear phishing greatly improves the chances that links and attachments are accessed. Internal spear phishing is used for lateral movement inside a network as opposed to an initial breach.

·         Whale Phishing Attack: Whale phishing is a type of spear phishing attack where the targets are high-ranking individuals, such as a CEO – the big phish, or whale, so to speak. Attackers may also pose as the CEO to issue fraudulent instructions to subordinates, also known as CEO fraud. The authority of such an individual makes it very likely that recipients comply with the email’s instructions. According to newly released data by Statista, the global volume of CEO fraud increased from 9,708 in 2017 to 17,607 in 2020. FBI’s 2021 IC3 report found that BEC was responsible for $2.4 billion in losses to U.S. companies in 2021.

·         Social Media Phishing Attack: As the name suggests, social media phishing attack is conducted on social media platforms like Facebook, Twitter, and LinkedIn. This type of phishing attack can take various forms. Attackers may simply post phishing scams that entice users to click on a link. They may also set up fake accounts to make acquaintances with users. Attackers then gather their personal information to guess their credentials and security answers or send them malicious files.

What are the Signs of Phishing?

Threats or a Sense of Urgency: Emails that threaten negative consequences should always be treated with skepticism. Another strategy is to use urgency to encourage or demand immediate action. Phishers hope that by reading the email in a hurry, they will not thoroughly scrutinize the content and will not discover inconsistencies.

Message Style: An immediate indication of phishing is that a message is written with inappropriate language or tone. If, for example, a colleague from work sounds overly casual, or a close friend uses formal language, this should trigger suspicion. Recipients of the message should check for anything else that could indicate a phishing message.

Unusual Requests: If an email requires you to perform non-standard actions, it could indicate that the email is malicious. For example, if an email claims to be from a specific IT team and asks for software to be installed, but these activities are usually handled centrally by the IT department, the email is probably malicious.

Linguistic Errors: Misspellings and grammatical misuse are another sign of phishing emails. Most companies have set up spell checking in their email clients for outgoing emails. Therefore, emails with spelling or grammatical errors should raise suspicion, as they may not originate from the claimed source.

Inconsistencies in Web Addresses: Another easy way to identify potential phishing attacks is to look for mismatched email addresses, links, and domain names. For example, it’s a good idea to check a previous communication that matches the sender’s email address.

Recipients should always hover over a link in an email before clicking it, to see the actual link destination. If the email is believed to be sent by Bank of America, but the domain of the email address does not contain “bankofamerica.com”, that is a sign of a phishing email.

Request for Credentials, Payment Information or Other Personal Details: In many phishing emails, attackers create fake login pages linked from emails that appear to be official. The fake login page typically has a login box or a request for financial account information. If the email is unexpected, the recipient should not enter login credentials or click the link. As a precaution, recipients should directly visit the website they think is the source of the email.

How to prevent phishing attacks?

Always be suspicious of password reset emails: Password reset emails are designed to help when you can’t recall the password for your account. By clicking on a link, you can reset the password to that account to something new. Not knowing your password is, of course, also the problem that cybercriminals face when trying to gain access to your online accounts. By sending a fake password reset email that directs you to a lookalike phishing site, they can convince you to type in your account credentials and send those to them. If you receive an unsolicited password reset email, always visit the website directly (don’t click on embedded links) and change your password to something different on that site (and any other sites with the same password).

Always note the language in the email: Social engineering techniques are designed to take advantage of human nature. This includes the fact that people are more likely to make mistakes when they’re in a hurry and are inclined to follow the orders of people in positions of authority.

Phishing attacks commonly use these techniques to convince their targets to ignore their potential suspicions about an email and click on a link or open an attachment. Some common phishing techniques include:

·         Fake Order/Delivery: A phishing email will impersonate a trusted brand (Amazon, FedEx, etc.) stating that you have made an order or have an incoming delivery. When you click to cancel the unauthorized order or delivery, the website (which belongs to a cybercriminal) will require authentication, enabling the attacker to steal login credentials.

·         Business Email Compromise (BEC): BEC scams take advantage of hierarchy and authority within a company. An attacker will impersonate the CEO or other high-level executive and order the recipient of the email to take some action, such as sending money to a certain bank account (that belongs to the scammer).

·         Fake Invoice: The phisher will pretend to be a legitimate vendor requesting payment of an outstanding invoice. The end goal of this scam is to have money transferred to the attacker’s account or to deliver malware via a malicious document.

In other words, if an email is urging you to take rapid or unusual actions, slow down and verify that it is legitimate before trusting it. Additionally, it is important to consider whether a phishing email’s tone is “on brand” for the supposed sender. Phishing emails will often – but not always – contain misspellings, grammatical errors, or unusual phrasing. If an email doesn’t “sound right”, then don’t trust it.

Never share your credentials: Credential theft is a common goal of cyberattacks. Many people reuse the same usernames and passwords across many different accounts, so stealing the credentials for a single account is likely to give an attacker access to a number of the user’s online accounts.

As a result, phishing attacks are designed to steal login credentials in various ways, such as:

·         Phishing Sites: Attackers will create lookalike sites that require user authentication and point to these sites in their phishing emails. Beware of links that don’t go where you expect them to.

·         Credential-Stealing Malware: Not all attacks against your credentials are direct. Some phishing emails carry malware, such as keyloggers or trojans, that are designed to eavesdrop when you type passwords into your computer.

·         Support Scams: Cybercriminals may pose as customer support specialists from Microsoft, Apple, and similar companies and ask for your login credentials while they “help” you with your computer.

Cybercriminals use a lot of different pretexts and scams to attempt to steal your account credentials. Never tell anyone your password, and, if an email points to a login page, visit the site directly and authenticate from there to protect against lookalike phishing sites.