BotNet News

Phishing is a social-engineering attack in which attackers create a counterfeit communication that looks legitimate and appears to come from someone the victim trusts. The attackers then trick the target into taking an action (clicking a link, visiting an infected site, downloading malware or surrendering login credentials) that enables them to steal money and/or data. They use tactics like fear, curiosity, a sense of urgency and greed to compel targets into taking the desired action.

To combat phishing, employees should use a combination of preventative actions and specialized security tools to ensure they are aware of the risks. For example, when using an email program, employees should mouse over links to check the domain. If it is unfamiliar, it should be considered a red flag and the link should not be clicked. Additionally, if the message asks for a money transfer or requests personal information, employees should contact the person directly through a known phone number to confirm the request is legitimate.

Often, attackers will mimic well-known brands, such as banks or retailers, to increase the likelihood of success. They may also spoof email addresses to appear as a person they know, such as a coworker or even the IRS. The attackers are also likely to use grammar and formatting that is consistent with formal communications from those companies, which makes it easier to spot a fake.

Other types of phishing include vishing, which is an email-based scam that targets people with access to financial systems. It can also include email account compromise (EAC), in which hackers gain access to lower-level employee accounts and then send fraudulent invoices to vendors or request access to confidential data. In addition, text message phishing, called Smishing, uses fake text messages to trick victims.