Learn About the Many Ways in Which Phishing Can Bait and Hurt You

In a previous article on our blog, we covered the concept of phishing in depth, understanding what phishing is, what makes people so vulnerable to phishing, and how can one identify and thwart a phishing attack on them. In case you missed reading it, here’s the link: What is a Phishing Attack

This article will look into the major types of phishing attacks and what can be the impact of a phishing attack on a business.

3 Main Types of Phishing Attacks

• Spear Phishing

While you are likely to reject a suspicious email from a stranger asking for confidential information, you wouldn’t be so quick to reject a similar email from a “friend”. Regular phishing attacks tend to be general and random in nature, so these are not so hard to spot for a sufficiently informed user. Far more effective than regular phishing is spear phishing, a customized phishing attack that is launched on a specific person or business.

To personalize the phishing attack, hackers do enough research into the business or individual that are on their radar. They find out various details about their target, like what’s their name, where do they live and work, who are they friends with, etc. On the basis of this research, hackers send customized phishing emails to the target, impersonating someone that the target knows and hence would trust. The email could ask for sensitive information and would most probably also contain an infected link or attachment. Such emails are so cleverly crafted that they may go undetected by email security measures too.

• Whaling Attack

Whaling attack and spear phishing attack are similar to each other in concept, but differ in the kind of users that each targets. While through a spear phishing attack hackers could target just about anybody, hackers rely on whaling attack to target the big guns within an organization, the likes of CEO, director, or any other executive. In a whaling attack, the attacker impersonates to be a powerful and important entity and targets someone who is actually powerful and important with a personalized phishing email or web page.

So, an example of a whaling attack could be an attacker sending an email, pretending to be CEO, to a divisional head of an organization. The attacker could ask the divisional head to urgently perform an action, like transfer a big amount of money or disclose business-related confidential information. If the divisional head is convinced that the email is sent by the actual CEO of the company, then he would perform the requested action and the whaling attack would be successful.

• Clone Phishing

The third type of phishing attack, and one that’s as dangerous as the other two types of phishing, is clone phishing. In clone phishing attacks, too, hackers choose their targets carefully and not randomly. The perpetrator would take a legit email (containing attachment) that has already been delivered once to their target and prepare an almost exact copy of this email. The sender’s email address as well as the content of the original mail would be replicated, the only difference in this cloned email would be that the original attachment or link would be replaced with an infected, malicious one. The target would be made to believe that the second email they have received is a resend or an update of the first one, therefore they would have little reason to doubt the authenticity of the cloned email. Assuming that the second email is safe just like the first one, the target would open the malicious attachment or link and inadvertently install a malware on their system.

An Overview of the Dangers That Follow a Phishing Attack

A successful phishing attack could result in several dangerous consequences for a business. Here’s an overview of two of these:

Advanced Persistent Threat

This is a type of cyber attack on network security that surreptitiously gains entry into an organization’s network, often through spear phishing emails, and continues to exist just as surreptitiously in the network for a long period of time. Because it remains hidden in plain sight, it can keep on stealing organizational information and tracking organization activities, while the organization remains clueless that their network and data security have been severely compromised. If an organization has a capable managed security services provider looking after its cybersecurity, then chances are that the provider would be able to detect that something’s amiss by looking out for any abnormalities in data transfers.

Ransomware

Ransomware and phishing are closely related to each other, because phishing is a weapon of choice for hackers for spreading ransomware. We just learned about the three kinds of phishing, which are sophisticated enough to deceive even the smartest of Internet users. Any of these phishing techniques could be used by the hackers to prompt the target to open a malicious link or attachment and accidentally set in motion a ransomware attack. To learn more about ransomware, read the following article “What is Ransomware.”