Phishing is a social engineering tactic that sees hackers attempt to gain access to personal or confidential information by posing as a legitimate company. In this article, Cyber Security Hub's editor Olivia Powell explores what phishing attacks are, why malicious actors launch phishing attacks and how companies can protect themselves against them.
For our guide explaining the different types of malware and how this can affect your business, visit Cyber Security Hub’s Ultimate guide to malware.
Contents
- Why do hackers launch phishing attacks?
- How common are phishing attacks?
- Phishing attacks that target individuals
- Phishing attacks that target companies
- Scams that harvest customer data
- Phishing attacks that harvest company data
- Phishing attacks and cryptocurrency
- How ChatGPT is making phishing scams harder to detect
- How to prevent phishing attacks
Why do hackers launch phishing attacks?
Hackers launch phishing scams to gain unauthorized access to sensitive information such as passwords, financial details or other personal data. The most typical motives are:
- Financial gain. With 95 percent of social engineering attacks motivated by financial gain, a significant number of phishing attacks have the same motive. Hackers may trick individuals into providing their financial details so they can steal money directly from their bank accounts or make unauthorized transactions.
- Credential harvesting. Also financially motivated, in this scenario hackers may steal a large number of credentials such as logins and passwords to be sold on the dark web.
- Identity theft. By stealing personal information such as usernames, passwords, credit card numbers or social security numbers, hackers can assume someone's identity to commit fraud or access their online accounts.
- Distributing malware. Phishing attacks are sometimes used to deliver malware such as viruses or ransomware, which then enables the hacker to take control of a device, steal data, or hold it hostage in exchange for a ransom.
- Espionage and surveillance. In some cases, phishing attacks are conducted by nation-states or organized cybercriminal groups to gather intelligence or monitor specific individuals. They can also be used to spy on businesses and steal proprietary information.
- Reputation damage. In these cases hackers impersonate an individual and send out deceptive emails on their behalf with the intention of harming their reputation.
How common are phishing attacks?
Phishing attacks soared in 2022, with international consortium and fraud prevention group the Anti-Phishing Working Group recording a total of 3,394,662 phishing attacks in the first three quarters of 2022. Each quarter broke the record as the worst quarter APWG has ever observed.
In the CS Hub Mid-Year Market Report 2022, 75 percent of respondents cited social engineering and phishing attacks as the top threat to cyber security at their organization. Experts believe that the economic crisis worldwide is contributing to the rise in phishing attacks as more people turn to cyber crime for financial gain.
Malicious actors typically use email, text messages and social media messages to target individuals and organizations.
Phishing attacks that target individuals
Malicious actors that use phishing attacks against individuals pose as legitimate companies, as victims are more likely to click on a link from a source they believe is trustworthy. These cyber attacks are often used to harvest login credentials, personal data or payment information from victims, which can either be sold to other bad actors on the dark web or used to commit credit card fraud or identity theft.
To appear legitimate, hackers often use channels typically deployed by companies to communicate with their customers, like email. As an example, I recently received an email from someone attempting to phish me by posing as Apple.
The use of a spoofed ‘no reply’ email address and a reference number also serve to make it look more legitimate.
Malicious actors may also use text-based phishing, known as SMSishing or smishing, to pose as a genuine company.
Since November 2020, people in the UK have been reporting being targeted by phishing attacks where malicious actors posed as the Royal Mail service, claiming that they needed to pay a fee for a parcel to be delivered. As potential victims are used to receiving updates from delivery services including Royal Mail via text message, this makes the message seem more legitimate.
Image source: the Royal Mail website
If someone entered their card details onto the site, their payment details were harvested. These details may have been sold on dark web sites dedicated to the trading and unauthorized use of credit card details, known as carding sites.
Phishing attacks that target companies
Phishing attacks that target companies and their employees are becoming increasingly common, often exploiting vulnerabilities within a company's communication channels.
Their aim is to either harvest data belonging to the businesses’ customers, or to access data belonging to the business itself. They may do this with the goal of extorting the company, or to sell the stolen information to other bad actors on the dark web.
Hackers may impersonate executives, trusted partners, or internal departments to trick employees into revealing confidential information, such as login credentials, financial data, or trade secrets.
These attacks commonly employ email or ‘spear phishing’, where the hackers have already gathered information about their targets such as their names, job roles and interests to create convincing messages that appear legitimate and relevant to the recipients. They may also use emails that mimic official company communication to prompt employees to click on malicious links or open infected attachments.
These attacks can give the hackers unauthorized access to internal systems, enabling them to install malware or steal sensitive data that can then be exploited for financial gain, sold on the black market or used for corporate espionage purposes. Cyber attacks like these can damage a company's reputation, erode customer trust and lead to financial losses due to regulatory penalties or legal actions.
Scams that harvest customer data
Malicious actors may use spear phishing attacks to harvest large amounts of customer data held by said companies. They may do this to extort companies using the threat of a data leak, to sell the information over the dark web or to data brokers, or to use the data for other purposes including identity theft.
A phishing attack in August 2022 against communications company Twilio led to 163 companies, each with hundreds of customers of their own, being affected by a data breach directly tied to the attack.
The breach, dubbed Oktapus by researchers, involved a targeted phishing attack against Twilio employees to gain unauthorized access to the company’s servers and its customer data.
After the cyber attack took place, a number of companies reported that their customer data was compromised during the breach, including messaging app Signal, who reported 1,900 users may have had their phone numbers revealed to hackers, with some users directly targeted.
Phishing attacks that harvest company data
Malicious actors may also use spear phishing attacks to harvest data relating to the company itself, for example information used to access the company’s network, source code information or other proprietary data.
In October 2022, cloud storage company Dropbox had its source code stolen by hackers after its employees were targeted by a phishing attack.
The cyber attack saw a malicious actor pose as code integration and delivery platform CircleCI in order to harvest login credentials and authentication codes from employees. It was also able to access Dropbox’s account on code repository site GitHub, as CircleCI login information can be used to log in to the site.
Throughout the cyber attack, the hacker gained access to some of the code Dropbox stores on the platform, including API keys used by its developers.
Image source: Yancy Min on Unsplash
GitHub itself reported a similar phishing attack in September 2022, involving a malicious actor posing as CircleCI to gain access to various user accounts.
The phishing site used by the hacker relayed time-based-one-time-passwords (TOTP) used for two-factor-authentication codes to the hacker in real time, allowing them to gain access to accounts protected by TOTP two-factor authentication.
The malicious actor was able to gain access to and download multiple private code repositories. This enabled it to use techniques to preserve its access to the account even in the event that the compromised user or organization changed their password.
Phishing attacks and cryptocurrency
With Bitcoin, Ethereum and Tether having market caps of $330.6bn, $152.6bn and $68.2bn respectively, cryptocurrency traders and wallets can be an attractive target for phishing attacks. So much so that Blockchain data platform Chainanalysis reported that a total of $3.8bn in cryptocurrency was stolen in 2022.
Phishing attacks against those who own cryptocurrency can have large payouts. In October 2022, a hacker known as Monkey Drainer used phishing attacks to steal $1mn worth of Ethereum and NFTs in just 24 hours.
Monkey Drainer is notorious for using phishing-based hacking techniques to steal from victims by setting up fake cryptocurrency and NFT sites.
To make these fake sites more believable, Monkey Drainer has been known to pose as legitimate blockchain sites including RTFKT and Aptos. After logging in to the fraudulent sites, victims enter sensitive details about their cryptocurrency wallets and sign off on transactions, allowing Monkey Drainer to access their wallets and their funds.
The most prominent victims in the October 2022 attack were referred to only as 0x02a and 0x626. The pair lost a collective $370,000 via malicious phishing sites operated by Monkey Drainer, with 0x02a losing 12 NFTs worth around $150,000.
How ChatGPT is making phishing scams harder to detect
While it was once relatively easy to spot a phishing email due to unusual greetings, poor spelling and grammar, advances in artificial intelligence (AI) are removing these red flags and making phishing scams ever more sophisticated.
The AI-powered bot ChatGPT has restrictions in place to prevent this kind of misuse, however by entering the right prompts hackers have been able to get around these safeguards.
Here are a few ways AI tools like ChatGPT are helping hackers advance their phishing efforts:
- Automated phishing. AI can be used to automate the generation of large volumes of phishing emails to reach more people.
- Human-like messaging. With its ability to simulate human language, ChatGPT and other AI-powered agents can create more realistic messages that are more likely to deceive the recipient into sharing personal information or click on a malicious link.
- Deceptive content. AI can be used to create generate realistic-looking websites and emails that closely resemble the real thing, making it harder to distinguish between legitimate and fraudulent content.
How to preventing phishing attacks
Teri Radichel, author of Cybersecurity for Executives in the Age of Cloud and CEO of cyber security training and consultancy company 2nd Sight Lab, says that is clear that attacks leveraging phishing and credentials are not going away.
When building their security strategy and threat defense protocols, Radichel suggests that companies “use a layered security approach to prevent damage if and when attackers compromise credentials”, both to defend against and mitigate these attacks. Additionally, Radichel notes that attackers are moving beyond basic web attacks to more sophisticated forms of attacks by leveraging automation and cloud environments.
Image source: the UK National Cyber Security Center (NCSC)
When considering phishing attacks that target individuals, the Canadian Center for Cyber Security (CCCS) provides the following advice:
- Verify links before you click them. Hover over the link to see if the info (sender/website address) matches what you expect
- Avoid sending sensitive information over email or texts
- Back up information so that you have another copy
- Apply software updates and patches
- Filter spam emails (unsolicited junk emails sent in bulk)
- Block IP addresses, domain names, and file types that you know to be bad
Call the sender to verify legitimacy (e.g. if you receive a call from your bank, hang up and call them) - Use anti-phishing software that aligns with the Domain-based Message Authentication, Reporting, and Conformance (DMARC) policy
- Reduce the amount of personal information you post online (e.g. phone numbers and extensions for employees)
- Establish protocols and procedures for your employees to internally verify suspicious communications. This should include an easy way for staff to report phishing attacks
- Use multi-factor authentication on all systems, especially on shared corporate media accounts