It’s one of the oldest forms of cyberattacks, but it’s still one of the most destructive. Phishing dates back to the 1990s, and techniques have become increasingly sophisticated over the years, thanks to the proliferation of effective templates and off-the-shelf tools.
In fact, nearly a third of the data breaches in 2019 involved phishing, according to the 2019 Verizon Data Breach Investigations Report.
Even with increased awareness and education, people are still falling victim to phishing attacks. The best way to prevent them is to understand how they work and the techniques used to carry them out.
So, how does phishing work? Let’s explore some of the most popular techniques used in 2019.
Phishing Attack Trends in 2019
Typically, phishing attacks are meant to gather financial account information, such as bank and credit card accounts.
In 2018, we started seeing a new trend: phishing attacks were targeting G Suite and Office 365. Now, attackers are increasingly interested intargeting businesses.
Attackers use the same methods as they do when trying to get financial information, but instead of impersonating a bank or credit card company, they impersonate software-as-a-service (SaaS) companies, like Slack, Dropbox or Office 365. Messages may claim that there’s suspicious activity on your account, or that your password needs to be changed. When you click on the message link, you’re sent to a spoofed page where the attackers gather your information.
But why would thieves want SaaS account information? A single compromised account could provide the attackers access to a wealth of information ranging from emails to sensitive company files. In some cases, that information can be used to log into other SaaS services, and the cycle continues.
Email has always been the primary platform for phishing attacks, but many cyber criminals are venturing out to other channels, including messaging apps like Facebook Messenger and WhatsApp.
The technique is the same; the delivery method is the only thing that has changed.
Instead of sending malicious messages through email, cyber criminals are using messaging and collaboration apps. People are less suspicious of these tools, so they’re more likely to click on a link and give up their credentials when they land on a spoofed page.
The Anatomy of a Phishing Attack Kit
Off-the-shelf tools like phishing kits allow cyber criminals to launch attacks even with minimal technical skills.
These kits include website tools and resources which need to be installed on a server. Once everything is installed, hackers only need to send emails to potential victims. Criminals can get a hold of email lists, and phishing kits for website spoofing, from the dark web.
If you take a closer look at what these kits include, it will give you a good idea of how many of these attacks work:
- Attackers start by creating a clone of a legitimate website.
- The login page of the cloned website is redirected to a script that steals your credentials.
- Emails are sent to potential victims, with links to the spoofed website.
- Victims click the link, enter their credentials, and their personal information is sent to the attackers.
Today, attackers are using more sophisticated techniques to trick victims into giving up their personal information.
Unfortunately, these platforms don’t have to the same security measures that email offers, such as malware detection, data leak protection and scanning. As a result, many people are falling victim to phishing attacks launched through messaging apps.
Get Ready for a Phishing-free 2020
Phishing attacks are becoming increasingly more sophisticated. Now that cyber criminals are branching out and using more platforms to launch their attacks, it’s more important than ever to educate employees, friends and family about the importance of guarding their personal information.
