What is a phishing attack?
Phishing is a type of attack often used to steal user data. This includes login details and credit card numbers. It occurs when an attacker, disguised as a trusted entity, tricks a victim into opening an email, instant message, or text message. Recipients are then tricked into clicking a malicious link. This can lead to the installation of malware, the freezing of the system as part of a ransomware attack or the revealing of sensitive information.
Attacks can hit organisations of any size and type. And such an attack often results in severe consequences such as financial loss, in addition to damaged reputation and customer trust.
Phishing attack example.
The following illustrates a common phishing scam attempt:
- A spoofed email is distributed to as many recipients as possible
- The email claims that the recipient has paid too much tax. They are given a link to reclaim their overpaid tax.
Several things can occur by clicking on the link. For example, this can provide hackers with access to the company network.
Phishing techniques.
There are various techniques which attackers use, two of the most commonly used are below.
Email phishing scams.
Using the most common phishing technique, the same email is sent to millions of users with a request to fill in personal details. These details will be used by the phishers for their illegal activities. Most of the messages have an urgent note which requires the user to enter credentials to update account information, change details, or verify accounts. Sometimes, they may be asked to fill out a form to access a new service through a link which is provided in the email.
Spear phishing.
Spear phishing is a much more targeted attack in which the hacker knows the specific individual or organisation. They do research on the target in order to make the attack more personalised and increase the likelihood of the target falling into their trap.
An attack might play out as follows:
- A perpetrator researchers names of employees within an organisation’s marketing department and gains access to the latest project invoices.
- Posing as the marketing director, the attacker emails a departmental project manager using a subject line that reads; Updated invoice for Q3 campaigns. The text, style, and included logo duplicate the organisation’s standard email template.
- A link in the email redirects to a password-protected internal document, which is in actuality a spoofed version of a stolen invoice.
- The project manager is requested to log in to view the document. The attacker steals his credentials, gaining full access to sensitive areas within the organisation’s network.
By providing an attacker with valid login credentials, spear phishing is an effective method for executing the first stage of a continuous computer hacking process.
Concerned about your security?
If the answer is yes. You can get in touch with our experienced team to find out how we can help.