Phishing in the Workplace
The attacker’s goal is to trick the victim into clicking a link, entering login credentials into a fake webpage, or downloading a malicious attachment. The most successful phishing attacks rely on fear or urgency to prompt the recipient into acting quickly without properly verifying.
Attackers also spoof identity cues by impersonating executives or vendors on phone and video calls using AI voice cloning and face-swapping. Urgent ad-hoc meetings on Zoom/Teams/Meet are common, and requests to bypass content filtering, share one-time MFA codes or grant remote access should be treated as high risk.
Encourage employees to check grammar, spelling and formatting in suspicious emails, as well as inconsistencies in the sender’s domain name (as revealed by hovering over a hyperlink). Legitimate communications from banks, credit card companies, payment services and the IRS should be free of grammatical errors, and address you by your first name rather than generically as “Dear Sir” or “Dear Madam.”
Links in suspicious emails may be shortened or contain minor variations in the URL text to evade email scanning tools, and they can include dubious file types such as.iso,.jscr or.pdf. Employees should be especially wary of shortened or misspelled links, as they will often reveal their true destination in the popup window when hovering over them. Additionally, it is important for employees to keep in mind that if the website they are being sent to doesn’t use HTTPS (shown by a padlock icon in browsers), the site could be compromised and should not be trusted.