What is Phishing?
Step 1: Choosing a victim
There are two types of phishing attacks:
Mass Phishing Attack – Aims for a general large population.
Targeted Phishing Attack – Chooses a high-profile, or specific, person/group.
Step 2: Setting Up the Source
The phisher first decides which brand name they want to use:
Brand Name – Phisher chooses a brand name for mass email distribution (LinkedIn, PayPal, etc.). They either create a fake website that resembles that brand name or hack into the real one.
Realistic Content – Phisher sends out a mock email requesting legal or financial information.
Step 3: Attack
Once that is decided, they carry out the attack by either:
Mass Distribution – Sending out a mass distribution email that includes fake, but believable web pages through links.
Targeted Distribution – Sending out an email to a smaller, precise group/person that includes fake, but believable web pages through links.
Step 4: Falling for the Trap
Their plan is successful if you end up giving out your personal information by either:
Clicking on the Fake Links – The victim is taken to a fake web page where you end up giving out your sensitive information to them.
Responding Directly to the Email – The victim obeys the instructions given in the email and end up replying with your personal information.
Step 5: Expansion and Monetizing
Once/If the plan goes as planned, the phisher proceeds to use the stolen information/money to:
Create More Attacks – The phisher may begin to collect more email addresses that have been hacked for their next attack.
Transfer The Money/Sell Information – The phisher ends up transferring the money to their account or sell the sensitive information to the black market.
What YOU Can Do to Prevent Being Phished:
- Your business should use email security inbound/outbound, URL rewrite, anti-spoofing, sandboxing and security awareness training.
- For more information, please visit: https://www.cyberteam.us/contact-us/ or call (914) 417-4814
- Contact Troy Insurance asking what extra measures are best for your policy regarding this type of cyber crime.
