Phishing is a deceptively simple cyberattack. At its core, it is a form of fraud: A message, most commonly an email, is disseminated to target or targets with the intent to have them perform a specific action, such as clicking a link, downloading an attachment, to facilitate one of two outcomes: the theft banking details, email credentials, and other sensitive information, or the insertion of malicious software into a company or personal computers. Phishing is often only the first in a long string of cyberattacks, with the many subsequent attempts mainly being facilitated by the first successful phish.

While an advanced threat intelligence system will help protect against a phishing attack, it is equally important to consider the human element—namely, the employees receiving the fraudulent emails. Phishing prevention, therefore, entails knowledge of what the most common phishing attacks might look like. Below are seven of the most common forms of phishing and how the current global climate has affected their sudden increase in usage.

Spear Phishing

By far the most common type, information about a target is gathered through various means, such as through publicly available social media platforms. A convincing, urgent-sounding email, sometimes posing as a friend or relative, and containing the malicious software or website link, is then created and sent.

Whale Phishing

This method passes up the rank-and-file employees and instead targets executive-level personnel to provide easier access to high-level company systems, which would otherwise be inaccessible to most other employees.

Smishing

Smishing differs from the usual phishing methods in that it delivers the attack through SMS or text messages. However, the actions being encouraged and the objective remain similar to other phishing attacks.

Vishing

Similarly, this method also follows the same principles as a standard phishing attack. The only difference is that malicious actors accomplish this through voice mail instead of a written email.

Business Email Compromise

This method entails acquiring the email credentials of a legitimate corporate email account, which is then used to impersonate the actual holder and defraud their host company or other business partners of cash or sensitive information.

Angler Phishing

This method forgoes email altogether and instead attempts to collect sensitive data or insert malicious software using social networking websites. These are primarily accomplished either through imitating system notifications and emails or through false job ads that require the submission of personal data.

Brand Impersonation

In this method of attack, the attacker impersonates a brand, company, or organization that potential victims would be likely to trust. Often, a convincingly similar domain or URL is used, which then directs victims to a website containing an urgent call to action, which then enables the usual objectives of a phishing attack.

Phishing attacks have been refined continuously over the years to impersonate legitimate businesses and entities more convincingly. However, the global pandemic has facilitated a staggering increase in phishing attempts, with cybercriminals taking advantage of the remote work climate to target not only individuals and small businesses but larger corporations and even government websites. Its dangers are further exacerbated by leveraging the panic around COVID-19, disguising phishing attempts as public service announcements or warnings from government and health authorities. As a result, phishing attempts have skyrocketed over the past year.

Cyberattack prevention may be a daunting task to undertake, but an effective service provider can defray most (if not all) of these cybersecurity concerns. Fraudwatch International’s phishing prevention services include round-the-clock, proactive monitoring, multi-layered email protection, and proprietary tools. Visit us today to learn more!