It’s a Sunday morning and Pam has just finished her report. As the newest member of the ABC Company, she wanted to make an impression. Beaming with pride, Pam scanned her report one more time before turning off her laptop, looking forward to the month-end meeting the next day.
Pam’s phone chimes. She looks at the screen and sees that it is from an unknown number.
The message reads:
ABC Company-Alert: Your registered mobile number needs to be updated. Update here: secureabcph.page.link/Login
Thinking that this may be an IT message to update her credentials, she opens the link and fills-in her details. She enters her username and password and clicks on the “Update” button. It only took a few moments to complete everything and Pam spent the rest of the day relaxing.
As Pam entered the meeting room the next day, there was a buzz of concern. Someone accessed the company’s network and deleted several classified files. Pam joined in. She found out that the breach happened yesterday afternoon, and to her absolute horror, the hacker used her credentials. She sank in her chair, helpless and distraught.
***
Phishing attacks have become one of the most common methods used by cybercriminals to steal sensitive information from individuals and organizations. This is a type of social engineering attack where the attacker impersonates a trustworthy entity to trick the victim into revealing their sensitive information, such as passwords, credit card details, and bank account numbers.
Phishing attacks can take many different forms, and they are constantly evolving. Here are some of the most common types of phishing attacks:
- Deceptive Phishing: This is the most common type of phishing attack. In this type of attack, the attacker sends an email that appears to be from a legitimate organization, such as a bank or a social media platform, and asks the recipient to provide their sensitive information. The email may contain a link to a fake website that looks like the legitimate website.
- Spear Phishing: This is a targeted phishing attack that is tailored to a specific individual or group. The attacker will research their target to gather information that can be used to craft a convincing message. They will use that to deceive their targets.
- Whaling: This is a type of spear phishing attack that targets high-level executives or other important individuals. The attacker will often pose as a CEO or other senior executive in order to gain the victim’s trust.
- Smishing: This is a phishing attack that takes place via SMS or text message. The victim receives a message from someone pretending to be a legitimate source, such as their bank, clicks on a link or enters their personal information after a prompt.
- Vishing: This is a phishing attack that takes place over the phone. The attacker will pose as a representative from a legitimate organization, such as a bank or credit card company, and will attempt to extract personal information from the victim.
- Clone Phishing: This is a type of phishing attack where the attacker creates a fake copy of a legitimate email and sends it to the victim. The email poses as a trusted source, but the content includes a malicious link or attachment.
- Pharming – This is a type of phishing attack where the attacker creates a fake website that looks like a legitimate website. It will ask visitors for their personal information.
Examples of Phishing Attacks Throughout History
The first recorded phishing attack took place in the mid-1990s, when attackers sent emails posing as AOL employees and asked users to verify their account information. The emails contained a link to a fake website where users were prompted to enter their login credentials.
One of the biggest phishing attacks in history took place in 2017, when attackers used a fake Google Docs invitation to gain access to users’ Google accounts. The attack affected millions of users and was quickly shut down by Google.
According to the Anti-Phishing Working Group (APWG), there were 241,324 unique phishing attacks in Q3 of 2021, representing a 22.1% increase from the previous quarter. The report also states that the Software as a Service (SaaS) industry was the most targeted industry, followed by the financial services industry and the E-commerce/retail industry.
In 2022, 255 million phishing attacks were detected, causing a 61% increase in the rate of phishing attacks compared to the previous year. It is estimated that these numbers will continue to rise by the end of 2023.
Detecting and Defending Against Phishing Attacks
So, how can you recognize a phishing attack and avoid falling victim to one? Here are a few tips:
- Be cautious of unsolicited messages: If you receive an email or text message that you weren’t expecting, be cautious. Don’t click on any links or download any attachments until you’ve verified that the message is legitimate.
- Look for warning signs: Phishing messages often contain spelling or grammatical errors. They may also have a suspicious sender address or URL.
- Check the source: Before entering any personal information, double-check the sender’s email address or the website’s URL to make sure it’s legitimate.
- Use two-factor authentication: Two-factor authentication adds an extra layer of security to your accounts by requiring a second form of verification, such as a code sent to your phone.
- Keep your software up to date: Software updates often contain important security patches that can protect you from known vulnerabilities.
- Use Antivirus Software: Install antivirus software on your computer to protect against phishing attacks.
- Businesses should also be open to consulting with cybersecurity companies, such as IPV Network, with the purpose of establishing a long-term partnership that can cover everything from threat intelligence solutions to online assets protection, data privacy, and more.
By staying vigilant and following these tips, you can help protect yourself from phishing attacks and keep your personal and business information safe.
About IPV Network
Since 2016, IPV Network has been a trusted partner of leading enterprises in the Philippines. It brings the best-of-breed cybersecurity solutions. IPV network helps businesses identify, protect, detect, respond, and recover from cyber threats. Email us at [email protected] or call (02) 8564 0626 to get your FREE cybersecurity posture assessment!
Sources:
https://www.phishing.org/history-of-phishing
https://docs.apwg.org/reports/apwg_trends_report_q3_2021.pdf
https://www.securitymagazine.com/articles/98536-over-255m-phishing-attacks-in-2022-so-far
https://www.checkpoint.com/cyber-hub/threat-prevention/what-is-phishing/
https://www.cloudflare.com/learning/access-management/phishing-attack/
