Phishing in the Workplace
Phishing is the use of email or other messaging to trick employees into sharing their credentials with threat actors. This allows attackers to access corporate data, make fraudulent payments, and more.
Attackers commonly use a combination of urgency, a sense of panic and unusual requests to trick recipients into taking action without thoroughly verifying an email’s legitimacy. Urgent requests requesting funds or claiming that an account is being locked, for example, can cause people to act quickly and without the proper consideration of risk. Attackers can also create a sense of panic or excitement by using high-quality images, well-known logos or recognizable brand names. These types of messages are easy to spot if you encourage your employees to take the time to pause, look closely at the message and assess its authenticity.
Another common warning sign is lack of context or vague details in an urgent request, or requests sent at odd times (e.g. outside of business hours). Also, beware of requests that exploit authority by claiming to be from an executive. Employees should confirm such requests via a different channel, such as their own internal communication system or by contacting the executive directly.
A variation on phishing is search engine phishing (also known as SEO poisoning), where hackers manipulate the results of a Google search to direct users to their hacker website that is designed to steal personal or organizational information when they click on it. This can even include a search engine result that appears above the legitimate website for an organization or individual.