The 5 Most Common Phishing Attacks (+3 New Emerging Threats)

Randomly you receive a message from your supervisor urging you to schedule a meeting for an exciting potential new client. Being proactive, you open the text, visit the link, and provide the requested calendar/contact info.  

Now, the reality? While proactivity is typically a plus, without realizing it, you just put your entire company’s infrastructure at risk.

Phishing: Why employees are easy prey

Phishing and social engineering attacks are rapidly evolving and remain the primary technique for threat actors attempting to penetrate your network. Being urged to schedule an important meeting for a supervisor or even CEO is the perfect example of how threat actors try to initiate a quick reaction that jeopardizes your infrastructure. Because as business domains develop, hackers can continue to rely on one element technology lacks—human emotion.

As cybercriminals continue to prey on untrained employees relentlessly, organizations everywhere are waking up to (1) our current cybersecurity climate, (2) the types of attacks present, and (3) the best strategies to defend their networks and employees. Because when…

• 1-4 employees admit to getting distracted and clicking a suspicious link

• 46% of organizations had at least 1 employee download a malicious mobile application

• 77% of organizations lack an incident response plan

And when a cyber-attack is launched every 39 seconds on average 2,244 times a day, businesses are essentially laying low-hanging fruit for hackers to infiltrate their perimeter through their front line of defense—staff.

The 5 most frequent phishing attacks

Educating teams on the dangers of cyber-attacks has become a necessary process at the forefront of every successful business security strategy—and it starts with knowing how to identify the typical types of threats employees are exposed to daily.

1. Email Phishing

Everyday millions of malicious emails that appear as regular requests are sent to employees at all levels. In most cases, hackers register fake domains that mimic a real business and send thousands of spoof requests hoping you fall for the imitation. In most cases, the phony domain often substitutes characters like ‘r’ and ‘n’ to create ‘rn’ instead of ‘m’.

Other times, a unique domain is created that includes a legitimate organization’s name in the URL. For example, recipients might see the “Amazon” in the sender’s address and assume it was an authentic email. In addition to the URL, always verify that the email or address does not:  

1. Contain grammatical/spelling errors
2. Have an unfamiliar email address attached
3. Push urgency
4. Provide a strange attachment
5. Appear sent from a public domain address
6. Have a missing or odd salutation
7. Have a missing or odd signature
8. Ask for personal info
9. Have a different display name
10. Contain a weird URL (hover over before clicking)

2. Spear Phishing

Spear phishing is a more sophisticated/forceful version of phishing involving targeted messages sent to a specific employee. Criminals who do this usually already have some or all the following information about the staff member:

• Name
• Place of employment
• Position
• Email address
• Intel regarding their role

Avoid spear phishing by testing employees on how to identify typical email phishing attempts and limiting how often you offer your data to websites or outside sources.

‍3. Whaling

Whaling is an even more targeted attack aimed at senior executives. Although the end goal is the same as any other phishing attack, whaling tends to be not as obvious. Ploys might appear more subtle than malicious URLs, as criminals try to imitate senior staff. And like our example from earlier, whaling attacks also commonly use the pretext of a busy CEO who wants an employee to do them a favor.

‍4. Smishing and Vishing

In smishing and vishing attacks, telephones replace emails as the main contact method for actors. Smishing involves criminals sending text messages with content similar to email phishing, while vishing involves an actual phone conversation.

Perhaps one of the most common smishing pretexts is alleged messages allegedly from your bank alerting you of suspicious account activity. Often these messages suggest you have fallen victim to fraud and instruct you to visit a page to prevent further damage. However, the link directs the recipient to a website further operated by the fraudster to capture your banking details.

‍5. Angler Phishing

A relatively new playing field for businesses, social media provides several ways for hackers to trick unaware individuals. Fake accounts, URLs, cloned websites, posts, tweets, and even instant messaging (like smishing) can all be used to persuade employees to divulge sensitive details or accidentally download malware. Criminals can also use the data staff post on social media to create highly targeted attacks and reach out in comment sections for any feedback that can provoke a reaction.

‍The rise of ransomware (+ 3 evolving threats)

Did you know that 80% of organizations that paid a ransom were hit by a second attack, and almost 50% were hit by the same threat group? Ransomware from phishing and social engineering attacks continue to rise and dominate as the biggest threat to businesses, but with the increase of remote and hybrid work models come new threats.

‍1. Zero-Day Exploits

Zero-day exploits take advantage of vulnerabilities in your system or device that have been disclosed but not yet patched. These attacks are on the rise as businesses continue to build complex infrastructures. The Microsoft Support Diagnostic Tool zero-day Follina vulnerability is an example of how a gap could be exploited to allow an unauthenticated user to control a system.

‍2. Nation-State Attacks

Nation-state attacks are a severe and evolving threat that organizations everywhere face. Their primary objective is to gain a strategic advantage for their country by stealing secrets, gathering cyber intelligence, conducting surveillance, or disrupting operations.

‍3. Supply Chain Attacks

Supply-chain attacks are emerging threats that target software developers and suppliers. The objective is to access source codes, construct processes, or update mechanisms by spreading malware through legitimate apps.

The takeaway

With an estimated three billion malicious emails sent daily, teams everywhere receive personalized and detailed attempts to penetrate your network. Training staff on the dangers of different phishing attacks is now essential, especially if your business wants to operate online. Because as social engineering attacks rise, so will ways to infiltrate the integrity of your network, making your front line of defense more important than ever.

‍