Tag Archive for: phishing scams

Beware of Phishing Attacks

Phishing attacks are increasing and getting more sophisticated. Here’s how to avoid them:

Phishing is on the rise, and anyone who uses email, text messaging, and other forms of communication is a potential victim.

These attacks, in which a cybercriminal sends a deceptive message that’s designed to fool a user into providing sensitive information such as credit card numbers or to launch malware on the user’s system, can be extremely effective if done well.

These types of attacks have become increasingly sophisticated — making them more dangerous — and more common. An October 2022 study by messaging security provider SlashNext analyzed billions of link-based URLs, attachments, and natural language messages in email, mobile and browser channels over a six-month period, and found more than 255 million attacks. That’s a 61% increase in the rate of phishing attacks compared with 2021.

The study revealed that cybercriminals are shifting their attacks to mobile and personal communication channels to reach users. It showed a 50% increase in attacks on mobile devices, with scams and credential theft at the top of the list of payloads.

“What we’ve been seeing is an increase in the use of voicemail and text as part of two-pronged phishing and BEC [business email compromise] campaigns,” said Jess Burn, senior analyst at Forrester Research. “The attackers leave a voicemail or send a text about the email they sent, either lending credibility to the sender or increasing the urgency of the request.”

The firm is receiving a lot of inquiries from clients about BEC attacks in general, Burn said. “With geopolitical strife disrupting ransomware gang activity and cryptocurrency — the preferred method of ransom payment — imploding as of late, bad actors are going back to old-fashioned fraud to make money,” he said. “So BEC is on the rise.”

Criminals using phishing attacks based on tax season, shopping deals

One of the iterations of phishing that people need to be aware of is spear-phishing, a more targeted form of phishing that often uses topical lures.

“While it is not a new tactic, the topics and themes might evolve with world or even seasonal events,” said Luke McNamara, principal analyst at cyber security consulting firm Mandiant Consulting. “For example, as we are in the holiday season, we can expect to see more phishing lures related to shopping deals. During regional tax seasons, threat actors might similarly try to exploit users in the process of filing their taxes with phishing emails that contain tax themes in the subject line.”

Phishing themes can also be generic, such as an email that appears to be from a technology vendor about resetting an account, McNamara said. “More prolific criminal campaigns might leverage less specific themes, and conversely more targeted campaigns by threat actors involved in activity like cyber espionage might utilize more specific phishing lures,” he said.

What people should do to ward off phishing attempts

Individuals can take steps to better defend themselves against phishing attacks.

One is to be vigilant when giving out personal information, whether it’s to a person or on a website.

“Phishing is a form of social engineering,” Burn said. “That means that phishers use psychology to convince their victims to take an action they may not normally take. Most people want to be helpful and do what someone in authority tells them to do. Phishers know this, so they prey upon those instincts and ask the victim to help with a problem or do something immediately.”

If an email is unexpected from a specific sender, if it’s asking someone to do something urgently, or if it’s asking for information or financial details not normally provided, take a step back and look closely at the sender, Burn said.

“If the sender looks legitimate but something still seems off, don’t open any attachments and mouse or hover over any hyperlinks in the body of the email and look at the URL the link points to,” Burn said. “If it doesn’t seem like a legitimate destination, do not click on it.”

If a suspicious-looking message comes in from a known source, reach out to the person or company via a separate channel and inquire as to whether they sent the message, Burn said. “You’ll save yourself a lot of trouble and you’ll alert the person or company to the phishing scam if the email did not originate from them,” he said.

It’s a good idea to stay up on the latest phishing techniques. “Cyber criminals constantly evolve their methods, so individuals need to be on alert,” said Emily Mossburg, global cyber leader at Deloitte. “Phishers prey on human error.”

Another good practice is to use anti-phishing software and other cyber security tools as protection against potential attacks and to keep personal and work data safe. This includes automated behavior analytics tools to detect and mitigate potential risk indicators. “The use of these tools among employees has increased significantly,” Mossburg said.

Another technology, multi-factor authentication, “can provide one of the best layers of security to secure your emails,” McNamara said. “It provides another layer of defense should a threat actor successfully compromise your credentials.”

If you are looking for an expert to help you find the best solutions for your business talk to GCInfotech about a free technology assessment

Published with consideration from CNBC.com SOURCE

/by
, ,

How to avoid a spear-phishing attack. 4 tips to keep you safe from timeless scams.

The hacker’s message is urgent and aimed directly at you. We’ll teach you how to keep from getting duped.

Everyone has access to something a hacker wants. To get it, hackers might aim a targeted attack right at you. The goal might be stealing customer data that’s useful for identity theft, your company’s intellectual property or even your personal income data. The latter could help hackers steal your tax refund or file for unemployment benefits in your name.

Targeted attacks, also called spear-phishing, aim to trick you into handing over login credentials or downloading malicious software. That’s what happened at Twitter in July, where the company says hackers targeted employees on their phones. Spear-phishing attacks also often take place over email. Hackers usually send targets an “urgent” message and include credible-sounding information specific to you, like something that could have come from your own tax return, social media account or credit card bill. These scams aim to override any red flags you might notice about the email with details that make the sender sound legitimate.

Despite corporate training and stern warnings to be careful who you give your password to, people do fall for these tricks. In addition to the Twitter fiasco, there was the release of Hillary Clinton campaign chair John Podesta’s emails, including his technique for making risotto (hint: keep stirring!). Podesta reportedly entered his personal username and password into a fake form designed by hackers specifically to capture his credentials.

Another consequence of falling for a spear-phishing scam could be downloading malicious software, like ransomware. You could also be convinced to wire money to a cybercriminal’s account. So how do you avoid falling for a spear-phishing scam? By taking these security habits to heart.

Know the basic signs of phishing scams

Phishing emails, texts and phone calls try to trick you into visiting a malicious website, handing over a password or downloading a file. This works in email attacks because people often spend the whole day at work clicking on links and downloading files as part of their jobs. Hackers know this and try to take advantage of your propensity to click without thinking.

Despite corporate training and stern warnings to be careful who you give your password to, people do fall for these tricks. In addition to the Twitter fiasco, there was the release of Hillary Clinton campaign chair John Podesta’s emails, including his technique for making risotto (hint: keep stirring!). Podesta reportedly entered his personal username and password into a fake form designed by hackers specifically to capture his credentials.

Another consequence of falling for a spear-phishing scam could be downloading malicious software, like ransomware. You could also be convinced to wire money to a cybercriminal’s account. So how do you avoid falling for a spear-phishing scam? By taking these security habits to heart.

Know the basic signs of phishing scams

Phishing emails, texts and phone calls try to trick you into visiting a malicious website, handing over a password or downloading a file. This works in email attacks because people often spend the whole day at work clicking on links and downloading files as part of their jobs. Hackers know this and try to take advantage of your propensity to click without thinking.

Despite corporate training and stern warnings to be careful who you give your password to, people do fall for these tricks. In addition to the Twitter fiasco, there was the release of Hillary Clinton campaign chair John Podesta’s emails, including his technique for making risotto (hint: keep stirring!). Podesta reportedly entered his personal username and password into a fake form designed by hackers specifically to capture his credentials.

Another consequence of falling for a spear-phishing scam could be downloading malicious software, like ransomware. You could also be convinced to wire money to a cybercriminal’s account. So how do you avoid falling for a spear-phishing scam? By taking these security habits to heart.

Know the basic signs of phishing scams

Phishing emails, texts and phone calls try to trick you into visiting a malicious website, handing over a password or downloading a file. This works in email attacks because people often spend the whole day at work clicking on links and downloading files as part of their jobs. Hackers know this and try to take advantage of your propensity to click without thinking.

Because spear-phishing scams can be so tricky, there’s an extra layer of caution you should apply before acting on a request that comes over email or the phone. The most important of these extra steps: guard your password. Never follow a link from your email to a website and then enter your account password. Never give your password to anyone over the phone.

Banks, email providers and social media platforms often make it policy to never ask for your password in an email or phone call. Instead, you can go to the company’s website in your browser and log in there. You can also dial back to the company’s call customer service department to see if the request is legit. Most financial institutions, like your bank, will send secure messages through a separate inbox you can access only after you’ve logged onto the website.

Beat phishing by calling the sender

If someone sends you something “important” to download, asks you to reset your account passwords or requests that you send a money order from company accounts, call the sender of the message — like your boss, your bank or other financial institution, or the IRS — and make sure they really sent it to you.

If the request came by phone call, you can still pause and double check. For example, if someone says they’re calling from your bank, you can tell the caller you’re going to hang up and call back on the company’s main customer service line.

A phishing message will often try to make the request seem incredibly urgent, so you might not feel inclined to add an extra step by calling the sender to double-check. For example, an email might say that your account has been compromised and you need to reset your password ASAP, or that your account will expire unless you act by the end of the day.

Because spear-phishing scams can be so tricky, there’s an extra layer of caution you should apply before acting on a request that comes over email or the phone. The most important of these extra steps: guard your password. Never follow a link from your email to a website and then enter your account password. Never give your password to anyone over the phone.

Banks, email providers and social media platforms often make it policy to never ask for your password in an email or phone call. Instead, you can go to the company’s website in your browser and log in there. You can also dial back to the company’s call customer service department to see if the request is legit. Most financial institutions, like your bank, will send secure messages through a separate inbox you can access only after you’ve logged onto the website.

Beat phishing by calling the sender

If someone sends you something “important” to download, asks you to reset your account passwords or requests that you send a money order from company accounts, call the sender of the message — like your boss, your bank or other financial institution, or the IRS — and make sure they really sent it to you.

If the request came by phone call, you can still pause and double check. For example, if someone says they’re calling from your bank, you can tell the caller you’re going to hang up and call back on the company’s main customer service line.

A phishing message will often try to make the request seem incredibly urgent, so you might not feel inclined to add an extra step by calling the sender to double-check. For example, an email might say that your account has been compromised and you need to reset your password ASAP, or that your account will expire unless you act by the end of the day.

To learn more about how to safeguard your business, or if you are looking for an expert to help you find the best solutions for your business talk to GCInfotech about a free technology assessment.

Published with consideration from CNET.com  SOURCE

/by