What is Phishing?
Phishing is a cybercrime that involves sending email, text or phone messages to a victim posing as a close personal contact or a trusted institution like your bank, social media app or even a government office. Its goal is to trick the victim into revealing sensitive information such as usernames/passwords, account numbers, home address, credit card details or other valuable data that can then be used to commit fraud, steal money, or attack a company’s computer systems.
Attackers are constantly refining phishing attacks to maximize their return on investment, making phishing one of the most prevalent cyber threats year after year. Attackers can use ready-made kits, spoofed sites and victim-tracking dashboards to deliver high volumes of attacks with minimal skill or effort. Its scalability makes phishing an attack of choice for attackers across all industries.
The earliest known phishing attack came in 1994 when a teenager from Pennsylvania developed AOHell to crack America Online accounts. Attackers use phishing to gain access to corporate and consumer networks to commit various types of crimes including ransomware, malware distribution and zombie network creation.
Many phishing attacks use fake attachments to gain access to a target’s computer system. Emails that contain attachments whose names do not correlate to the message’s contents are likely phishing and should be discarded immediately. Attackers also use fake URLs to spoof legitimate websites and entice victims into visiting a malicious site where they can enter credentials or install malware. For example, the 2014 Sony hack was initiated by phishing emails that tricked employees into downloading malware from a fake Apple ID verification website and bypassing their company’s SecurID two-factor authentication system.