Explores this widespread and dangerous attack vector
Phishing is a social engineering tactic that sees hackers attempt to gain access to personal or confidential information by posing as a legitimate company. In this article, Central Report Members explores what phishing attacks are, why malicious actors launch phishing attacks and how companies can protect themselves against them.
Contents
- Why do hackers launch phishing attacks?
- Phishing attacks that target individuals
- Phishing attacks that target companies
- Phishing attacks and cryptocurrency
- How to protect against phishing attacks
Why do hackers launch phishing attacks?
Phishing attacks soared in 2022, with international consortium and fraud prevention group the Anti-Phishing Working Group recording a total of 3,394,662 phishing attacks in the first three quarters of 2022. There were 1,025,968 attacks in Q1, growing to 1,270,883 attacks in the third quarter, with each quarter breaking the record as the worst quarter APWG has ever observed.
Ernie Moran, general manager of automated prepaid card fraud protection software Arden at financial protection service Brightwell, believes that 2023 will continue to see a rise in phishing attacks due to more people turning to cyber crime for financial gain.
“The downturn in the economy this year will almost certainly lead to an increase in individuals taking additional risks to commit fraud in 2023, but many financial organizations are still unprepared to identify and take action on a coordinated and targeted fraud attack,” he explains.
“The downturn in the economy this year will almost certainly lead to an increase in individuals taking additional risks to commit fraud” - Ernie Moran, general manager of Arden at Brightwell
This financial gain may be from harvesting personal or banking information from individuals and either using or selling it. It may also be gained via accessing confidential information held by companies. They may do this with the goal of extorting the company, or to sell the stolen information to other bad actors on the dark web.
Malicious actors can use a variety of channels to send phishing attempts including texts, social media messages and emails. They can also use a variety of phishing techniques in order to gain access to this information.
Phishing attacks that target individuals
Malicious actors that use phishing attacks against individuals pose as legitimate companies. This is because victims are more likely to click on a link from a source they believe is trustworthy. These attacks are often used to harvest login credentials, personal data or payment information from victims, which can either be sold to other bad actors on the dark web or used to commit credit card fraud or identity theft.
These phishing scams are supposed to appear legitimate, so they often use channels typically deployed by companies to communicate with their customers, like email. As an example, I recently received an email from hackers attempting to phish me by posing as Apple.
Phishing attacks and cryptocurrency
Bad actors launching phishing attacks primarily do so for financial gain, whether this is through the theft of payment or banking information, or by selling information gathered through phishing attacks.
With Bitcoin, Ethereum and Tether having market caps of $330.6bn, $152.6bn and $68.2bn respectively, cryptocurrency traders and wallets can be an attractive target for phishing attacks. So much so that Blockchain data platform Chainanalysis reported that a total of $3.8bn in cryptocurrency was stolen in 2022.
Phishing attacks against those who own cryptocurrency can have large payouts. In October 2022, a hacker known as Monkey Drainer used phishing attacks to steal $1mn worth of Ethereum and NFTs in just 24 hours.
Preventing phishing attacks
Teri Radichel, author of Cybersecurity for Executives in the Age of Cloud and CEO of cyber security training and consultancy company 2nd Sight Lab, says that is clear that attacks leveraging phishing and credentials are not going away.
When building their security strategy and threat defense protocols, Radichel suggests that companies “use a layered security approach to prevent damage if and when attackers compromise credentials”, both to defend against and mitigate these attacks. Additionally, Radichel notes that attackers are moving beyond basic web attacks to more sophisticated forms of attacks by leveraging automation and cloud environments.
When considering phishing attacks that target individuals, the Canadian Center for Cyber Security (CCCS) provides the following advice:
- Verify links before you click them. Hover over the link to see if the info (sender/website address) matches what you expect.
- Avoid sending sensitive information over email or texts.
- Back up information so that you have another copy.
- Apply software updates and patches.
- Filter spam emails (unsolicited junk emails sent in bulk).
- Block IP addresses, domain names, and file types that you know to be bad
Call the sender to verify legitimacy (e.g. if you receive a call from your bank, hang up and call them). - Use anti-phishing software that aligns with the Domain-based Message Authentication, Reporting, and Conformance (DMARC) policy
Reduce the amount of personal information you post online (e.g. phone numbers and extensions for employees). - Establish protocols and procedures for your employees to internally verify suspicious communications. This should include an easy way for staff to report phishing attacks.
- Use multi-factor authentication on all systems, especially on shared corporate media accounts.