How Phishing Attacks Work, and Why They Succeed
Phishing attacks are wildly successful: 91 percent of all cyber breaches include phishing, according to Deloitte. Traditional phishing involves sending an email that looks legitimate, purporting to come from the institution or a friend or colleague. The email may have an embedded credential harvester or a link to a .edu domain that is actually a clone of the legitimate web page where users enter their credentials.
With the advent of remote working and learning, cybercriminals are increasingly using multichannel phishing to evade email security and exploiting the use of text messages and collaboration tools such as Slack, Zoom, Microsoft Teams and other channels that are less protected. Mobile devices are an attractive target because they are less secure, their content may be truncated, and users are often distracted as they multitask.
For example, the cybercriminal may send a WhatsApp message with an invitation to a Teams meeting. When the user enters credentials on the cloned website, the criminal can take over the account and deliver additional attacks via Amazon Web Services and Microsoft Azure, Outlook and SharePoint.
What Do Vishing and Smishing Mean?
Vishing and smishing attacks are increasingly popular vehicles for multichannel phishing attacks.
Vishing attacks involve phone calls or voicemails from someone claiming to be from the target’s bank, the target’s employer, the IRS or law enforcement. Targets are notified that their computer is infected, their password has expired or there is suspected fraud; to fix the problem, they must share personal information. Because scammers can place multiple calls at once using VoIP and can spoof the caller ID to make the call look legitimate, it’s easy to fool people.