Phishing Is The Hackers' Favourite Tool

Phishing is often the first stage of a larger attack that can lead to data breaches, ransomware infections, identity theft, and other serious consequences. Phishing attacks use deception to trick people into giving away sensitive information or taking actions that compromise business security. 

Email phishing is the most common type of phishing technique and is ubiquitous for many users, who may receive numerous different ones every day. Typically, these emails inform the recipient that their account been a compromised in some way and requests an immediate by clicking on a provided link. 

Now, the US Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Federal Bureau of Investigation (FBI), and Multi-State Information Sharing and Analysis Center (MS-ISAC) have jointly produced a Guide to help users protect themselves against phishing threats.

They explain that social engineering is the attempt to trick someone into revealing information (e.g., a password) or taking an action that can be used to compromise systems or networks. Phishing is a form of social engineering where malicious actors lure victims (typically via email) to visit a malicious site or deceive them into providing login credentials. 

Hackers use phishing for different malicious purposes:- 

Obtaining login credentials: Malicious actors conduct phishing campaigns to steal login credentials for initial network access. 

Malware deployment:   Malicious actors commonly conduct phishing campaigns to deploy malware for follow-on activity, such as interrupting or damaging systems, escalating user privileges, and maintaining persistence on compromised systems. 

This is achieved using a range of different techniques:

  • Sending emails that look like they come from your boss, co-worker, or IT staff.
  • Using text messages or chat platforms to trick you into giving your login credentials.
  • Using Internet phone services to fake caller IDs makes you think they are calling from a legitimate number.

How your organisation can defend itself:-

  • Train yourself and others on how to spot and report suspicious emails.
  • Use Domain-based Message Authentication, Reporting, and Conformance (DMARC) for emails.
  • Set DMARC to “reject” for outgoing emails.
  • Monitor internal email and messaging traffic.
  • Use strong Multi-factor Authentication (MFA) for your credentials.
  • Check MFA lockout and alert settings.
  • Use Single Sign On (SSO) for centralised logins.

Phishing With Malware

This is a phishing attack where hackers pose as a reliable source and make you interact with malicious links or email attachments, which can run malware on your devices. The two most common techniques are:-  

  • Sending links or attachments that make you download malware.
  • Using smartphone apps and text messages to deliver malicious content.

There are several different methods of defending against these attacks  including:- 

  • Use Deny lists at the email gateway and firewall rules to block malware delivery.
  • Do not give users administrative rights.
  • Apply the principle of least privilege (PoLP).
  • Use application Allow lists.
  • Disable macros by default.
  • Use remote browser isolation solutions.
  • Use protective DNS resolvers.

 Reporting Phishing Incidents

If you experience a phishing incident, you should take steps to reset compromised accounts, isolate affected devices, analyse and remove malware, and restore normal operations. Indeed, Reporting any phishing activity to relevant authorities is important in identifying and mitigating new threats.

Phishing attacks are a major threat, but with effective training, security measures, and incident response procedures in place, you can significantly reduce your risk of falling victim to these attacks. 

CISA:   Imperva:   Trend Micro:    Fortinet:    IT Governance:   Cybersecurity News:     

Image: Brian J Tromp

You Might Also Read:

The Latest Trends In Email Threats:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Is OAuth Authentication Secure?
Increase Security For Your Enterprise Cloud With A Next-Generation Firewall »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

Bishop Fox

Bishop Fox

Bishop Fox is a leading authority in offensive security, providing solutions ranging from continuous penetration testing and attack surface management to product and application security assessments.

High-Tech Bridge

High-Tech Bridge

High-Tech Bridge SA is a Swiss MSSP provider offering security auditing, source code review and computer forensics.

RCMP Cybercrime Strategy

RCMP Cybercrime Strategy

The RCMP Cybercrime Strategy sets out in an Operational Framework and Action Plan to combat cybercrime.

CSI

CSI

CSI is a Managed Service Provider (MSP) delivering Hybrid Multi-Cloud, Data Protection, and Cyber Security solutions to highly regulated industries.

Maritime Cybersecurity Center (MCC)

Maritime Cybersecurity Center (MCC)

Maritime Cybersecurity Center is a not-for-profit organization focused on regional cybersecurity excellence and readiness, with a special emphasis on the maritime community.

Cansure

Cansure

Cansure is a leading insurance provider in Canada offering a broad range of property & casualty insurance solutions including Cyber & Data Breach insurance.

CyCraft Technology Corp

CyCraft Technology Corp

CyCraft is an AI company that forges the future of cybersecurity resilience through autonomous systems and human-AI collaboration.

Base Cyber Security

Base Cyber Security

Base Cyber Security is an information and cyber security talent service provider and career specialist.

Titans24

Titans24

Titans24 is a Software-as-a-Service security platform for web applications. It prevents attacks on business websites that are protected under 11 cyber-security layers.

Aries Security

Aries Security

Aries Security provides a premiere cyber training range and skills assessment suite and develops content for all levels of ability.

Tetra Defense

Tetra Defense

Tetra Defense is a leading incident response, cyber risk management and digital forensics firm.

Gridware

Gridware

Gridware is a specialised cybersecurity consultancy firm and an emerging global player in the cybersecurity intelligence and advisory field.

Herzing College

Herzing College

Herzing College Ottawa offers an accelerated 12-month Cybersecurity Specialist training program. This program is developed by industry experts and based on leading IT security certifications.

rSolutions

rSolutions

rSolutions delivers managed cybersecurity services to clients in many industry sectors including financial services, telecommunications, energy, government and retail.

ISO WISH

ISO WISH

Take your Business to the Next Level with ISO Certification in UAE.

Defendis

Defendis

Defendis develops AI-powered cybersecurity solutions for Government Agencies, Banks, and Businesses, designed to helps them contain data leaks, minimise damage, and proactively hunt for new threats.