What Is Phishing?

Email Phishing

Email phishing is the most common type of phishing. Attackers use emails to carry phishing information because emails are widely used and many phishing technologies, such as link manipulation, are more likely to be present in emails. In addition, enterprises usually use emails as a tool for internal communication. Given that phishing is often the first step to intruding on enterprise systems, email phishing has become the first choice for many attackers.

Phishing emails typically have some features in common. For example, these emails often create a sense of emergency, containing information such as "please handle this as soon as possible" and "it's urgent", which leads to victims disclosing personal information to attackers out of panic. What's more, is that phishing emails often contain syntax and spelling errors, while emails sent from official organizations usually do not contain such errors.

There are various forms of email phishing. Some common email phishing techniques are listed below.

Spear Phishing

Spear phishing is a more targeted type of email phishing. Relatively speaking, common email phishing is more random. Attackers cast a wide net and do not have specific details on their victims, but disseminate their emails widely in the hope that a few will fall for the scam. Spear phishing, on the other hand, targets specific victims. By conducting a detailed investigation of a victim's characteristics, position, and contacts through social engineering, spear phishers formulate a highly reliable phishing technique to increase their rate of success. Spear phishing is often the first step in breaking past the defense line of an enterprise's security system.

The following is a typical example of what happens: A victim in the Human Resources department of a company receives an email from a sender who claims to be a job applicant. The email contains an attachment that is disguised as a resume, but is in fact an executable Trojan horse. The victim is accustomed to receiving resumes from others and downloads the attachment, falling into the trap of the attacker.

Whaling

As the name suggests, whaling involves hunting for the big fish within a company. It is a special type of spear phishing that targets a company’s top executives. The reason why whaling attracts wide attention is that top executives usually have access to a large amount of sensitive company data. Successful whale phishing attacks could cause great losses to a company.

BEC

Strictly speaking, the business email compromise (BEC) technique forms a part of spear phishing and is usually the second step of whaling. In a BEC scam, an attacker pretends to be a decision maker in a company and sends instructions related to funds and interests to other departments or individuals of the company through emails. Different from traditional phishing, such attacks do not target victims' personal information or have victims download malicious software or click on malicious links. Instead, they steal funds directly, for example, by requiring a company's finance department to initiate a transfer to a partner or customer. Although BEC attacks are less technical than other phishing techniques, they can still cause huge economic losses to companies.

For example: A victim from a company's finance department receives a private email from the company's CEO, asking him/her to initiate a remittance of up to tens of millions of dollars to a third-party partner and to keep the remittance confidential. Out of trust in the company's CEO, the victim initiates the transfer and falls into the attacker's trap.

Vishing and Smishing

Vishing and smishing are phishing attacks that happen over your phone, either through calls or SMS messages. The two techniques are aimed at elderly victims who are not familiar with the Internet and do not know about attackers' "exquisite" tricks. They are therefore less susceptible to more high-tech attacks. For this group of people, attackers use more traditional methods, that is, phone calls or text messages. Many attackers use robots to complete the deception, as high-level robots can now almost perfectly imitate humans, which significantly improves the efficiency of attackers.

Social Media Phishing

Social media has long become an integral part of our lives. We use social media to share personal information and we have linked bank accounts and credit cards to our profiles to make online payments. This makes it possible for criminals to use social media to launch phishing attacks. Social media phishing includes phishing attacks spread through social media, phishing attacks planned by collecting victims’ information on social media, and phishing attacks that hack into victims' social media accounts.

Here is an example: After hacking into a victim's social media account, an attacker uses the account to send a QR code or link to the user's relatives and friends, who unlikely to suspect their friend and are therefore more likely to become new victims themselves.

Pharming

Pharming is a more complex and effective method of phishing. It can be carried out either by changing the hosts file on a victim's computer or by exploiting a vulnerability in DNS server software. A pharming hacker can redirect victims to a phishing or malicious website after they enter a website address. In most cases, the success of common phishing attacks is the result of carelessness or the victim's lack of security awareness. However, when a threat actor launches a pharming attack, even if a victim enters a website's address correctly, the attacked DNS server will still redirect the victim to a malicious website.

Evil Twin Attack

Many people have had the experience of connecting to free Wi-Fi hotspots in public places. These free hotspots are likely to be Wi-Fi access points forged by evil twin attack hackers. A hacker creates a fake Wi-Fi access point in a public place, that is, an "evil twin" of the real Wi-Fi access point, to deceive victims into connecting to it. Once the victims' devices are connected to the Internet, the hacker can steal the victims' account passwords and personal information.