Networking phishing attacks can be defined as attempts to manipulate users into sharing sensitive and important financial data e.g., credit card details and pin numbers. In order for an attack to be successful the disguise has to be exceptional and difficult to spot. The attacker knows this which makes a potential phishing attack complex and difficult to differentiate from genuine information. There is one method that is more common than most and represents a significant proportion of those attacks. That method is via either email or text message. The victim will receive notification from an organisation they have a relation with like a bank or government contact. The notification will usually consist of urgent language with a call to action in place to scare the recipient. Failure to do so will resort to a form of consequence that is severe enough for the attacker to leverage a hold of the recipient, pushing them to take the form of action referenced in the email or text message.

Within the email or message there will be a link to take the victim through to a log in. If the victim, then clicks the link and believes in the message enough to fill in a password and username the attacker will receive the information themselves and will then be able to access all the information within that account. By being able to access this high level of information the attacker is able to leverage this and use it for financial gain. For example, selling bank account information and personal information on the black market. Within the tech sector, phishing attacks are commonly regarded as the most simple but also the most dangerous attacks of all. This is because they don’t just impact a network, but they also involve mental manipulation and the exploitation of people's fear. Whereas other forms of attacks such as malware are exploiting technical and security malfunctions. The use of social engineering makes this form of attack unique but also extremely difficult to stop.

Types of phishing

Spear Phishing

Spear phishing is designed to attack a specific group or individual. This means that the messaging behind the email is specifically designed for them, making it personal and even more dangerous. In order to carry out this successfully it requires the attacker to gain some accurate inside information to use as leverage. This is essential in order to push the victim into action. For example, an attacker might do background research in order to be able to target someone at an organisation that handles financial responsibilities.

Clone phishing

This type of phishing contains a copy or very similar version of a previous engagement that contains a link. These legitimate links are then replaced by malicious disguises. These can be incredibly hard to differentiate and make up a large proportion of successful cyber attacks. By clicking on the link, the user allows their system to be accessed, along with any data or sensitive information. Once the attacker has gained access to the system they can pose as a member of the company and leverage power from there.

Phone phishing

In the case of a phone phishing attack, the perpetrator will pretend to be an institution you have a close relationship with e.g., bank. With this method the attack is planning on catching the victim off card, presenting a problem that is relatively severe and can be solved over the phone. This will involve a financial transaction over the phone and the exchange of financial details. In order to prevent tracking the perpetrator will usually insist on pay via wire transfer or pre paid cards.

Signs of a phishing attack

A phishing attack is difficult to differentiate because it will be addressed by someone you know or someone that works within your company. A good way to tell is if this person is part of your everyday communication line at your company, if so, is the topic of discussion, a regular topic or something completely unrelated? The tone in which the message sets, particularly if threatening, should be a sign of caution as this will not be company policy so points towards something more sinister.

Within any form of cyber attack the content will contain a link or form of attachment that may contain either ransomware or malware. If any of the above signs exist, it is clearly advised that you don’t access the link or document.

How to avoid a phishing attack

There are several ways to avoid becoming victim to a phishing attack but they require caution. This is due to the fact they can be quite difficult to detect amongst genuine content. This can range from excess caution when clicking on links within emails to manually entering the link to the legitimate site yourself in another browser. You can also take the messaging from within the email and enter it into another browser to see if this is a widely accepted phishing attack.

When discussing phishing attacks, it is important not to underestimate its effect on ransomware and malware attacks. They are the first phase of ransomware and malware attacks, relied upon to engage the victim into downloading the software. This is widespread and affects all industries and all sizes of companies.