Understanding Phishing Attacks

• Phishing attacks involve sending fraudulent communications that appear to originate from a reputable source.
• Phishing is usually carried out through email
• The goal of phishing is to steal sensitive data, such as credit card details and login credentials, or to install malware on the victim's device.

How Phishing Works

• Phishing operations generally use one of two basic methods.

Malicious Attachments

• These are malicious email attachments installing malware on the victims’ machines when opened
• The attachments usually have enticing names like 'INVOICE' to trick users into opening them.

Links to Malicious Websites

• Malicious links redirect users to websites, frequently clones of legitimate sites.
• These websites either download malware or contain login pages designed to harvest user credentials.

Dangers of Phishing

• Phishing poses several risks to both individuals and businesses

Personal Risks

• Money theft from bank accounts
• Fraudulent charges on credit cards
• Loss of access to photos, videos, and files
• Fake social media posts made in your accounts
• Cybercriminals impersonating you to a friend or family member, putting them at risk.

At Work Risks

• Loss of corporate funds
• Exposure of personal information of customers and coworkers
• Files becoming locked and inaccessible
• Damage to the company's reputation.

How Phishing Scams Work

• Phishing is a widespread style of identity theft due to the ease with which people share personal information.
• Phishing scams often use spam email and messages, requesting users to "verify your account" or "confirm your billing address" on a malicious website.
• Phishers can only reach you if you respond.

Identifying Phishing Attacks

• Signs indicating you are targeted by a phishing attack.
• Requests for confidential information via email or instant message
• Emotional language with scare tactics or urgent requests
• Misspelled URLs, spelling mistakes, or the use of sub-domains
• Links contained within the body of a message
• Lack of a personal greeting or customized information.

Protecting Yourself from Phishing

• To safeguard against phishing

Methods of Protection

• Do not provide personal information in response to unsolicited requests.
• Only provide personal information on sites that have "https" in the web address or display a lock icon before the search bar.
• Contact the company by phone if you suspect an email is phishing bait to confirm whether the message is legitimate.
• Use varied and complex passwords for all your accounts
• Avoid clicking malicious links/attachments without verifying the source’s authenticity.

Forms of Phishing Attacks

• Email Phishing
• Voice Phishing (Vishing)
• SMS Phishing (Smishing)
• Typosquatting (URL Hijacking)
• Clickjacking
• Cryptocurrency Phishing

Email Phishing

• Email phishing often appears in your email inbox with a request to follow a link, send a payment, reply with private info, or open an attachment.
• The sender's email might closely resemble a valid one and contain personalized information.

Voice Phishing (Vishing)

• Vishing involves scammers calling you, impersonating a valid person or company to deceive you.
• The scammer might redirect you from an automated message and mask their phone number.
• The scammer will try to keep you on the phone and force you to take action.

SMS Phishing (Smishing)

• Smishing is similar to vishing, and uses a scheme to imitate valid organizations using urgency in a short text message.
• The message typically includes a link or a phone number for you to use.

Typosquatting (URL Hijacking)

• Typosquatting is social engineering, targeting internet users who incorrectly type a URL into their web browser.
• It involves tricking users into visiting malicious websites with URLs that are common misspellings of legitimate websites.
• For example: A website uses a variation of a real website name, changing a letter.

Clickjacking

• Clickjacking uses multiple transparent layers to place malicious clickable content over legitimate buttons.
• For example: an online shopper might download malware while attempting to make a purchase,

Cryptocurrency Phishing

• Crypto Phishing targets those with cryptocurrency wallets.
• Instead of using long-term means to mine cryptocurrency themselves, the criminals try to steal from those that already have these funds.