What is phishing?

Key takeaways:

• Phishing involves fraudulent emails to steal sensitive information.

• Hackers mimic trusted authorities like banks to deceive victims.

• Victims may unknowingly install malware or share credentials via fake websites.

• Tools like phishing kits make phishing attacks widespread and persistent.

Phishing is the act of using fraudulent emails in an attempt to gain sensitive information about a victim.

With the advancements in technology and the introduction of new tools, like phishing kits, these attacks are as widespread today as they were when they first emerged.

How is phishing carried out?

1. Create fake communications:

   1. Attackers send emails, messages, or even social media notifications that appear to be from legitimate sources, such as banks, government agencies, or popular websites.

2. Mimick trusted websites:

   1. Victims are directed to fraudulent websites that closely resemble real ones, where they unknowingly enter sensitive details.

3. Use urgency or fear:

   1. Phishing messages often claim that an account has been compromised or requires immediate action, pressuring users to respond quickly.

4. Embed malicious links or attachments:

   1. Clicking on infected links or downloading harmful attachments can install malware, giving hackers access to the victim’s system.

Phishing techniques

Phishing attacks come in various forms, each designed to exploit vulnerabilities and trick individuals into revealing sensitive information. Below, we discuss some common phishing techniques to help you recognize and avoid these scams.

1. Email phishing scam

An attacker sends hundreds of authentic-looking emails, as seen in the example below. These emails do not contain any personal information. The hacker believes that a handful of people will fall prey to such techniques and, therefore, their data can be gathered. The hacker tries to generate an email that mimics the original email as closely as possible. This can trick even the most careful users. The message is usually marked urgent, and therefore, the user will act immediately without confirming that the email is actually from the bank.

2. Spear phishing

Spear phishing is similar to email phishing in that hackers email the victim. These emails, however, are more targeted and may contain the name and information of that particular user. This builds credibility, making the user more likely to fall prey.

3. Whaling

Whaling is similar to an email phishing attack except for targeting high-ranking employees (e.g., CEOs and other high-value targets). These emails claim to require immediate action and are from other corporate or government agencies, which usually ensures that a CEO will click the attachment and become a victim.

The following image shows an example of a phishing email and the ways to identify its authenticity:

Common features

• Urgent: Phishing emails will usually ask the users to take prompt action as a security risk may be involved.

• Links: The email may contain links the user is asked to click to update passwords, login, etc.

• Attachments: The email may contain attachments that ask to be downloaded.

• Sender: The email will not be sent from an official company, bank, or government email.

• Offers: Offers from supermarkets or online stores that are too good to be true. Free laptops, phones, or huge discounts may lure the victim.

Preventing phishing attacks

• Verify requests: Contact the company directly to confirm the email's legitimacy.

• Avoid clicking links: Instead of email links, visit the company’s official website via a browser search.

• Use security software: Install software to detect viruses and trojans.

• Enable multi-factor authentication (MFA): Legitimate websites, unlike fake ones, often require MFA.

• Check URLs carefully: Look for subtle changes in the URL, such as “.org” instead of “.com.”

• Ensure secure connections: Verify that the website uses HTTPS for encryption, as most legitimate organizations do.

Test yourself

Before moving on to the conclusion, test your understanding.

Conclusion

Phishing attacks, while evolving in sophistication with tools like phishing kits, remain a persistent threat. By understanding common tactics such as email phishing, spear phishing, and whaling, and implementing preventive measures like verifying requests, avoiding suspicious links, and utilizing strong security measures, individuals and organizations can significantly reduce their vulnerability to these cyber threats.