Many internet users have once experienced hoodwinking from unscrupulous individuals deceiving them to provide relevant personal information across the web such as passwords for credit cards only to realize that it was a scam. Some of the manipulation tricks are even personalized to portray them as genuine as possible and make them hard to detect. This is an example of phishing.
So what is phishing?
In efforts to explain what’s phishing, technology researchers, cybersecurity experts, and scholars provide various phishing meanings but all define one thing. Phishing is a social engineering scheme that tricks web users to provide personal data to attackers who disguises themselves as a trusted entity. In most cases, the cyber attackers use text messages, email spoofing, or telephone calls to lure people to provide the sensitive data pretending to be legitimate representatives of corporate and government organizations including banks, social security organizations who request the users to offer such important information to either help them improve their performance or troubleshoot a specific problem. When the web users succumb to phishing, it ends up causing expensive damages as some attackers may install malware on the system, illegally withdraw cash, and even make payments.
Moreover, when organizations experience phishing, the staff could be enabled to access sensitive data, systems deflated, huge financial losses, and suffer the loss of brand trust. As a result, organizations could take time to recover from phishing attacks.
Types of phishing
There exist various types of phishing that target web users.
Spear phishing
Spear phishing is a way of creating a message that targets a specific enterprise or person. They may have researched the norm behavior and position of the entity or they can even design appealing content. For example, an attacker can investigate the finance manager of a specific company and unearth the latest project invoices. He can send a spoofed email to the account officer with a link that contains a password document. When the account officer logs in the attack records or the credentials that will enable him to access the company’s accounting system.
Whaling phishing
Whale phishing is a form of spear phishing that focuses on the most senior authorities within an organization. Unlike the other types of phishing that target vulnerable users randomly, whaling phishing targets the “big fish” with the expectation to reap more.
The attackers would target the board of directors, big shareholders, chairman, and Chief Executive Officers.
Pharming phishing
In pharming phishing, the cybercriminals craft a URL that redirects a user to an invalid and malicious website that is infected with malware. Consequently, when a person is tricked to click the fake website, he unknowingly shares personal data.
Clone phishing
Clone fishing is one the common types of phishing where a previously legitimate delivered email is resent by an attacker to a certain address with close resemblance of the first email. The first email contains original links and attachments. But the second spoofed email contains content, attachments, and links that are fake, and it is sent to the original recipient. In an instance, the receiver clicks the links he falls on malicious online attacks. There are also other types of phishing such as voice phishing, SMS phishing, social media phishing, and domain spoofing.
There is no doubt that phishing remains to be a major cyber threat in many organizations. Most cyber attackers take advantage of crisis times to target people who are looking for swift information and solve their problems. Regardless of the type of attacks, it is important before clicking an email or providing any online feedback to be watchful to avoid any malicious attachments and links. Also, most phishing messages sound too good to be true, have a sense of urgency and they come from new sender addresses. For corporate and government organizations investing in foolproof cybersecurity measures is the ideal way.
