What Is Phishing?

What Is Phishing?

Phishing is a form of social engineering where a threat actor sends one or more fraudulent communications to a user in an attempt to trick them into downloading malware onto a device or forfeit sensitive information such as login credentials, personal identifiable information (PII) or financial data. In most cases, phishing usually occurs through communication channels such as email, SMS messages, social media or phone calls.

How Does Phishing Work?

In the event of a phishing attack, threat actors will send fraudulent communications made to look like they are coming from a reputable source. Appealing to emotions such as fear, curiosity, urgency and greed, threat actors will attempt to get users to ignore basic cybersecurity hygiene and click a link or download an attachment, which could be a malicious webpage, shell script, or even a Microsoft Office document containing a malicious macro. If the user is fooled, they risk leaking sensitive information and may also experience identity theft, data loss or infection of their device or network with malware, including ransomware.

Phishing attacks have become one of the most prevalent methods of cybercrime because they are effective due to their ability to avoid detection methods. Most phishing is sent via email as it is simple to deploy and easy to send large quantities of messages in a single attempt. Adding to the ease of deployment is the availability­ of low-cost phishing kits. These phishing kits are collections of tools, such as website development software, coding, spamming ­software and content, which can be utilized to collect data and create convincing websites and emails. The addition of more sophisticated and evasive phishing techniques has also enabled even novice threat actors to bypass traditional security defenses.

The Objective of Phishing Attacks

Motivated by financial or informational gain, a hacker typically deploys a phishing attack to steal data, money or, in some cases, both.

Once a malicious link is clicked, the cybercriminal may download malware onto the device. This allows them to gain access to the user’s sensitive information or possibly move laterally within the network to infect other devices. The threat actor may opt to sell the data to third parties for profit, hold it for ransom, or destroy the victim’s or company’s data if demands aren’t met.

Attackers may also collect contacts from the original victim that can be used in future phishing attacks.

Most Common Types of Phishing

Depending on the objective and intended target, threat actors will use different types of phishing techniques to trick the user into falling victim. Each of the following forms of attacks may be used to achieve different objectives.

Spear Phishing

Spear phishing is the most common form of phishing. An attacker uses gathered intel on an individual to create a personalized email message that often includes a malicious link or attachment. When the user opens the attachment, malware is executed on the target’s device, which gives the attacker access to their private information.

Whaling

Whaling is a form of phishing that is targeted at high-profile executives of a company. The objective of whaling is to gain access to extremely confidential information through email communication. Many times, the message appears urgent to convince the receiver to act quickly. In this case, the victim may click a malicious link without thinking beforehand, enabling the attacker to steal login credentials and sensitive data or download malware.

Smishing

Smishing acts in the same way as other phishing attacks, but it comes in the form of an SMS message. Oftentimes, the message will contain a fraudulent attachment or link, prompting the user to click from their mobile device.

Vishing

Vishing, also called ‘voice phishing’, is when an attacker targets victims over the phone to gain access to data. To appear legitimate, the attacker may pretend that they are calling from the victim’s bank or a government agency.

Angler Phishing

Attackers who use angler phishing attacks utilize a social media platform to create a fraudulent profile posing as a customer service agent. They reach out to users who have expressed frustration with a specific company to help “solve” their issues. In this communication, the victim may then send their personal information to the fake account, which allows the hacker to access their account.

Dangers of Phishing

As one of the main tactics used in successful data breaches today, there are many risks that come with falling victim to a phishing attack. Many users and organizations have had personally identifiable information (PII), credentials and sensitive data stolen, resulting in identity theft, money and reputation loss, as well as disruption of daily operations and productivity. With phishing attacks continuing to increase in sophistication and volume, it is critical for organizations and individuals to take extra steps to prevent these attacks from taking place.

How to Prevent Phishing Attacks

As with any organization, a comprehensive security platform that addresses people, technology and processes minimizes the likelihood of a successful phishing attack. In the case of people, security awareness training will educate the recipients on what to look for in a phishing attempt and report it to their security teams. While phishing attack methods may change, many of them share common warning signs, so continually practicing good cybersecurity hygiene will help avoid potential attacks.

When it comes to technology, organizations should look to deploy a malware analysis solution which will analyze the unknown link or file and implement policies to prevent access if it is determined to be malicious. Deploying a web security solution is also strongly recommended as it can block modern-day web-based threats like phishing and prevent an organization from becoming patient-zero.

To learn how you can protect yourself from modern day threats like phishing, check out Palo Alto Networks Advanced URL Filtering solution.