As businesses are moving online, online threats have become more common too. When you are surfing the internet or operating a business online you might come across shady websites, messages, or people. There are many cyber-attacks including Zero-day attacks, malware attacks, and different types of phishing attacks that you might face online.
A phishing attack is a kind of socially engineered attack that uses different phishing techniques to manipulate users into revealing their private data like credit card details and log-in information. These techniques include sending fake emails and sms or redirecting users to fake websites and fake domains.
10 Types of Phishing Attacks
Sneaky attackers on the internet can catch prey where they least expect it. So when you know one type of attack, you might fall for a different trap. Here are 10 types of phishing attacks you need to be aware of.
|
Phishing Attack |
Damage It Causes |
Who Is At Risk |
|
Spear phishing |
significant financial loss and identity theft. |
Individuals with high-profile positions, and employees in a specific organization. |
|
Vishing |
Financial loss, identity theft, and fraud through voice calls. |
General public, especially those who are trusting or elderly. |
|
Email phishing |
Financial loss, identity theft, malware infection, and data breaches. |
General public, and employees of organizations. |
|
Pharming |
Redirects users to malicious websites, leading to identity theft and financial loss. |
General public, online shoppers. |
|
Pop-up phishing |
Malware infection, identity theft, and financial loss through deceptive pop-ups. |
General public, online users. |
|
Evil twin phishing |
Identity theft, financial loss, and data interception through fake Wi-Fi networks. |
Public Wi-Fi users, travelers. |
|
MiTM attacks |
Interception of sensitive information, leading to identity theft and financial loss. |
Online users, especially those using public Wi-Fi. |
|
Domain spoofing |
Identity theft, financial loss, and malware infection through fake websites. |
Online users, customers of targeted organizations. |
|
Whaling |
Targeted attacks against high-level executives, leading to significant financial loss and reputational damage. |
Executives, C-suite level employees. |
|
Smishing |
Financial loss, identity theft, and malware infection through SMS messages. |
The general public, mobile phone users. |
Spear phishing
This type of phishing attack is more specific than others. In this, attackers first gather information about a particular individual, this person is usually a senior-level employee at a firm with sensitive information about the company. Attackers do homework on these profiles and then send them emails or calls to trap them.
Example:
An Accounts manager can receive a message that appears to be a senior officer of the company requesting urgent payroll information or logging in to accounts.
How To Avoid It
-
Be careful with unexpected emails, especially if they include personal details.
-
Do not give sensitive information in emails.
-
Check if the email address is correct before indulging.
Vishing
Vishing is the kind of attack that involves voice calls. In these attacks, attackers will pretend to be someone trusted like a friend or a relative on a phone call, and gather sensitive information from you. In this attack, attacks might ask you for your credit card info or pretend to be in distress so that you send them money.
Example:
A relative calls and says they are stuck somewhere and need an urgent money transfer and they will return it late, this can make you worried and you send them money without further investigation.
How To Avoid It
-
If you get a call from a relative or a friend asking for favors, try contacting them on some other medium or known number.
-
Do not give your sensitive information or credit card details on the call, see for the policies of an organization to see if they even ask for anything like that.
-
Avoid answering calls from unknown numbers, and block suspicious numbers.
Email Phishing
Email phishing is the most common kind of phishing technique. In this type of phishing attack, attackers send emails pretending to be a trusted organization encouraging you to give them your data. These types of phishing emails have email addresses similar to authentic emails with 1 or 2 alphabets changed or a fake email address that has the name of the real organization in it.
Example:
You may receive an email from a popular store, telling you about this limited discount offer and sending you a link to avail of this offer.
How To Avoid It
-
Look for spelling mistakes in the email address.
-
Do not download any file or image attached in the email as they may have malware.
-
Check for the authentic email address of the organization before replying.
-
Don't give your sensitive information.
Pharming
A pharming attack is called that because it lets the attackers attack many individuals together and harvest their information on a large scale, in this kind of attack a malicious code file is downloaded in your device that manipulates IP which redirects users to a fake website when you try to access the real website. It then steals your credentials and other sensitive information.
Example:
If your device has these malicious codes installed, and you access your bank website, this might lead you to another fake website that looks exactly like the original one and you use your credentials giving attack your details and so every other infected device takes.
How To Avoid It
-
Use good anti-phishing and anti-malware software.
-
Use authentic and trusted browsers when you need to work with your private information.
-
Do not visit shady websites to avoid putting yourself at risk of downloading an unwanted file.
Pop-up Phishing
This phishing attack manifests as a pop-up on your screen, as a notification that there is a security problem or an error message on your device prompting you to click on it. When you click on the pop-up a file downloads to your device that contains malware such as spyware. This pop-up can also get you to call a supposed support center which is a call to attackers.
Example:
You might get a notification that says your computer is downloading an infected file and when you click on it you might get malware that can corrupt your files or steal data.
How To Avoid It
-
Download a good ad blocker to avoid getting any pop-ups.
-
Do not click on pop-ups, especially the one claiming a prize or looks dangerously urgent as it is a psychological trick to trap.
-
Keep your browser and operating system updated.
Evil Twin Phishing
The evil twin is a phishing technique that involves wifi. A user becomes a victim of this phishing attack when they login to this fake WiFi set by attackers, who make it look genuine. When someone connects to this wifi, it steals any information that the user has put online including login credentials, credit card information, and other sensitive data.
Example:
You are in a mall and you need to make an online payment or check your bank account balance so you connect to the available public wifi, and when you log in to your bank account the attackers get your details.
How To Avoid It
-
Use your mobile data instead of public Wifi at bus stops and shopping malls.
-
Only use trusted Wifi networks.
-
Don't put personal information online when using public data.
Man-in-the-middle (MiTM) Attacks
These are the kinds of attacks that happen when two parties are communicating with each other through emails, messages, or phone calls. On the surface, the communication is direct but attackers are there monitoring the communication, they might interfere and alter messages or eavesdrop on the calls.
Example:
A phone call between a bank helpline operator and user is tapped and so the attacker gets all the information shared on this call.
How To Avoid It
-
Use HTTPS websites for secure connections.
-
A VPN-added security can also help with confusing attackers.
-
Double-check on other mediums of communication if the message you received was tempered.
Domain Spoofing
This is similar to pop-up phishing. These two phishing techniques are kind of the same as they both are related to fake domains that look real. In Domain spoofing attackers create fake domains and then steal information like your credentials and credit/debit card information. These domains might also send malware to your computer to spy on your online activity.
Example:
You try to log in to your social media account lets say you are logging in to your instagram account whose URL is supposed to be www.instagram.com but you are directed to some other domain with the URL “www.instagran.com” and your login credentials are stolen.
How To Avoid It
-
Double-check the address of a website and verify email addresses too.
-
Be cautious of suspicious emails or links.
-
Always use reputable websites when making a transaction.
Whaling
The whale is a ‘Big Fish’, a term often used for important people in an organization. Whaling is a phishing attack that targets these big fish like CEOs or CFOs of a company. When whaling attackers have strong knowledge of the company network it allows them to gain trust and trick these people.
Example:
Let’s say you are a Senior Manager at a company and you get a call from someone pretending to be in your team that needs a file or a document that is related to their work but is confidential, so you send them the file and attackers get sensitive information.
How To Avoid It
-
Put strong email filters and spam protection to avoid whaling attacks.
-
Companies should train their employees to recognize phishing attacks.
-
multi-factor authentication can help you deal with these attacks too.
-
Verify if an email requests for sensitive information.
Smishing
Smishing is a type of phishing attack where attackers trap users through sms and messages. These sms contain malware so when you open such a message, it gets downloaded to the device. It can also contain a link to fake websites so when you log in to them you give your sensitive information to them.
Example:
You get an SMS from what appears to be your network providers, telling you that your data package is expiring and attaching a link to see how many MBs are left.
How To Avoid It
-
Avoid unsolicited text messages that ask for personal information.
-
Do not click on any links in suspicious messages.
-
Avoid indulging in a conversation, do not reply to such SMS.
FAQs
What type of attack is phishing?
Phishing is a socially engineered cyber attack in which attackers steal your sensitive data like credentials, usernames, and credit card information through emails, phone calls, fake websites, etc.
Which type of phishing targets specific individuals and companies?
Spear phishing and whaling are types of phishing attacks that target specific individuals and companies to steal their data.
Is phishing a form of social engineering?
Yes! Phishing is a type of social engineering because it is a manipulation technique that traps people into giving out confidential information or performing actions that compromise security.
While there are many predators out there, with their sneaky phishing techniques waiting for you to make a small mistake that can lead them to steal your information or money you should be very careful when you are working or just scrolling online. Always verify a website before entering sensitive data, and check email addresses and links before you click on them. Be smart with the choices you make online because a single mistake can lead to huge consequences.
For more information on cyber attacks stay tuned to Virtual Codes Blog.
