Stealing Sensitive Online Information - Modern-Day Trend

Phishing:

Nowadays, 70% of cyber attacks come from social engineering, in which phishing is one of the major techniques of social engineering used by cybercriminals to attack businesses, organizations and individuals. A successful cyber-attack can cost a small business an incredible amount of money to recover. In addition, some organizations may not recover from such attacks.

According to Wikipedia, Phishing is a type of social engineering where an attacker sends a fraudulent (“spoofed”) message designed to trick a human victim into revealing sensitive information to the attacker or install malicious software on the victim’s infrastructure like ransomware.

Phishing attacks are gaining more momentum because they are easy to set up, rewarding, and pose little risk to cybercriminals. It can be as simple as hosting a fake web page or malicious file, sending spoofed emails to victims, and waiting for stolen access or data. Unfortunately, phishing is one of the most frustrating threats we face. Most of us know what it is and how it works, but we still get caught out. 

There are several types of phishing attacks. Here are some of the attacks:

 

1. EMAIL PHISHING:

Arguably the most common type of phishing, this method often involves a “spray and pray” technique in which hackers impersonate a legitimate identity or organization and send mass emails to as many addresses as they can obtain. 

These emails are often written with a sense of urgency, informing the recipient that a personal account has been compromised, and they must respond immediately. Their objective is to elicit a specific action from the victim, such as clicking a malicious link that leads to a fake login page.

Unfortunately, after entering their credentials, victims deliver their personal information straight into the scammer’s hands. Also, a mail can contain malicious attachments such as a link or document, so as the recipient clicks on it, the malware executes and compromises the user systems.

 

2. SPEAR PHISHING:

Although spear-phishing uses email, but it takes a more targeted approach. Cybercriminals start by using open-source intelligence (OSINT) to gather information from published or publicly available sources like social media or a company’s website.

Then, they target specific individuals within the organization using real names, job functions, or work telephone numbers to make the recipient think the email is from someone else inside the organization. Ultimately, because the recipient believes this is an internal request, the person takes action mentioned in the email.

 

3. SMISHING AND VISHING:

With both smishing and vishing, telephones replace emails as the method of communication. Smishing involves criminals sending text messages (the content of which is similar to email phishing), and vishing consists of a telephone conversation.

For example, a common vishing scam involves a criminal posing as a fraud investigator (the card company or the bank) telling the victim that their account has been breached. The criminal will then ask the victim to provide payment card details to verify their identity or transfer money into a ‘secure’ account. But, of course, they mean the criminal’s account if you haven’t figured it out yet. 

Here are some helpful tips to avoid getting phished by these harmful websites. Let’s divide our solutions into two.

 

BEFORE CLICKING

The major thing we should remember is that nothing comes free on the internet. How can you expect free data worth 30GB from your services providers, or maybe the federal government will share a certain amount without proper announcement?

So, to avoid being a victim, you need always to check and study the URL before you click it: The hypertext transfer protocol secure (HTTPS) is often considered a “safe” link to click because it uses encryption to increase security. In addition, most legitimate organizations now use HTTPS instead of HTTP because it establishes legitimacy. 

However, cybercriminals are now leveraging HTTPS in the links that they put into phishing emails. Therefore, whenever someone sends you a link via email or social media, or in any platform for that matter, take time to study the URL before you click. 

You don’t have to be an expert in spotting a suspicious URL. Just look for some red flags on the link. Fake links generally imitate established websites, often by adding unnecessary words and domains.

Identify the source of the link: Did you know the person who sent you the link? If you have even a drop of doubt, don’t click the link. 

For example, Ade had a problem with his bank, and thinking he could get a faster response via Twitter, he tweeted his concern to the bank’s Twitter handle. A “bank representative” replied within a few hours by linking him to the “bank’s support page”. 

Ade was smart enough not to trust the “representative” because he knew not to trust unverified Twitter accounts. As a result, Ade just encountered, and fortunately avoided, one of the most popular types of phishing attacks on social media.

 

AFTER CLICKING

Let’s say you accidentally clicked a phishing link. You shouldn’t panic just yet. Instead, as mentioned above, study the URL of the webpage and look for the obvious red flags.

Fake web pages usually display lots of meaningless characters in the address bar or include extra text strings. For example, Facebook.com can be changed to faceb00k.com, and it will look exactly like the actual Facebook website. At this junction, you need to be very careful before you input any info or better, you can use some online tool like the whois database to know more about the domain is an excellent action to take.

Also, some online phishing links identifier can help you analyze the link sent to you. Clicking on a malicious link in an email or any other platform can hand over the data and system of an organization or individual to a hacker.

They are then free to do what they want, including theft for other criminal purposes, corruption, and deletion. Therefore, data loss is considered the most severe effect of phishing attacks.