Why Choose Samurai Security?
Our team of experts can offer training on the basics of information security awareness, this includes information about phishing attempts, such as how to spot an attempt, what the email may looks like, who they might be targeting and the do’s and do not’s of using emails safely.
The samurai team can also perform a phishing campaign for your organisation, where we would release several example phishing emails into the inbox of your organisation and create a report detailing how much information was gained from employees and which departments appear to be lacking in cyber security awareness. Once this campaign has been completed, any areas of concern can be carefully patched up and education through training can be offered by our team, to ensure that your organisation remains safe and secure.
What is Phishing?
Phishing is where an attacker will contact many potential targets, either through phone, text message, or more commonly, email, while posing as a legitimate party or institution, such as a bank, service provider, or sales outlet, in order to gather important or personal information from their targets.
An example would be an email from amazon asking for your login details to be verified, or fake PayPal email, which contains a malicious link, when this link is clicked, you’ll be redirected to a fake page which may infect the target with a virus, or save the login credentials to take over the targets account.
Attackers may use content in emails that illicit an emotional response, such as a family member in an emergency, threats of account closures or fines if information isn’t given up quickly, they work by targeting many people at once and hoping that a few will be in a vulnerable position and will respond without fully looking into the situation. An example of this would be an email about a grandkid who is lost in another country without money and “needs funds transferring immediately”. Many people would ignore this, all it takes is for one person to have a grandchild abroad and worryingly respond without checking that it is in-fact them.
Each day, it is expected that up to 156 Million phishing emails are sent every day and out of those, it is expected that 16 Million will make it through spam filters, and half of those are opened, leaving up to 8 Million people at risk every day.
Phishing can be a method used in conjunction with social engineering, which is a method of obtaining information, while impersonating another individual, either of higher ranking, or someone known to the target.
For more information on phishing attacks, fraudulent emails and increasing awareness, Phishtank, is a phishing awareness website which allows people to submit information about possible phishing attacks, making more and more attempts become known for what they are.
Apple Phishing email
Recently more businesses have had their names and logo used to make phishing emails looks more legitimate to the targets, while asking for important information, such as account credentials, or where apple phishing emails are concerned, Apple ID’s, temporary verifications codes or even banking and credit card information.
Any reputable company will never ask for account information via email and any apple emails containing hyperlinks, or password reset instructions, which haven’t been requested by yourselves, should be considered suspicious and could very well be apple phishing emails.
What is Email Spoofing?
Email spoofing is where someone forges an email and makes it look like it originated from a trusted source, in an attempt to get the recipient to divulge sensitive information, for instance, an email could be from a well- known source, such as Amazon, Apple, or PayPal, asking for sensitive information, including passwords or credit card details, leading the recipient to believe they are speaking to a trusted source and just verifying their account details.
Email spoofing can also be used to target businesses, where the attacker would pretend to be a CEO or CTO of a company, requesting payments be made to different payment accounts than usual or asking for account information due to an accidental lock out. These attempts are also called spear phishing, where specific targets are chosen based on the information they may be able to divulge.
While attackers may craft their own emails and spoof them using complicated techniques, there are now tools available that make email spoofing easy for even the least technologically inclined individuals, meaning more spoofing attacks are happening every day.
Fake PayPal Email
PayPal is a well-known secure payment business, which many people hold accounts with. Fake PayPal emails are used to try and get recipients to believe they have made a payment to someone, when they didn’t. The email would include a hyperlink to a malicious website, where the target would attempt to log in with their credentials, without realising the attacker is logging this information, so they can withdraw funds from your account.
Fake PayPal emails are also used to get recipients to send verification codes for transactions on other websites such as eBay, where they forge an email from PayPal, which states something similar to, “Dear PayPal customer, we are holding funds from [Buyers account name] Please mail the package and submit the tracking code here, then £XX will be released and transferred into your account”
PayPal Phishing is where an attacker will forge the details and mimic the sender to look like the email is legitimate and came from PayPal, they use Generic information such as “Dear User” or “Dear Sir/Madam” instead of your accounts username or your real name.
To entice you into clicking a hyperlink contained in the email, the attacker will add in some form of urgency, stating that your account has been suspended, or that if you don’t act soon you may have to pay a fine. Often a fake email will contain some grammatical or spelling errors, whereas a legitimate email has likely been through a thorough process to ensure quality and would usually be free of these.
PayPal Phishing Email
PayPal phishing emails or PayPal fraudulent emails, could also contain attachments, which supposedly contain invoices or statements, these could easily be malicious files that infect the receivers device, in order to gain personal information or monitor their activity. There is also a good chance PayPal phishing emails will ask for attacking number for an item, in order to release funds being held for a bought item. A legitimate company will never ask for any information like this, instead it would all be done through the website and payments should show in your account when logging in.
If a suspicious email is received, the best course of action is to manually go to the website and check that any of the emails contents are present there, without clicking any potentially harmful hyperlinks in the email. This is the quickest way to verify an untrusted email. Sometimes these emails will go into the spam folder, sometimes they can even be forwarded to the relevant vendor to be tagged as a spam email, this can also be done using your mail provider, if an email is thought to be suspicious or malicious, it is recommended to forward to the spam folder, with notes such as “PayPal spam”.
There are many terms searched today online, these include “Phishing Facebook”, “Spoofing attack”, “TV license phishing”, and ‘Phishing meaning’ is searched quite a lot, all with the attempt to gain an understanding in one of today’s most prominent cyber-attacks. ‘Phishing’ came about from the way an attacker chooses multiple targets, often thousands at a time, in the hopes that at least a few will take the bait. This is similar to the way a fisherman will choose a popular spot where fish are located and cast out their lure in hopes that even if most of the fish ignore it or swim away, at least a few might take the bait and they will catch some of the fish.
Types of Phishing
There are multiple types of phishing, while phishing is generalised, phishing examples can include, malicious emails, texts or calls, which target Multiple people, there is also spear phishing (pretends to be a trusted source such as CEO to gain information) and whaling (Specifically targets ‘Big fish’ such as company heads, or people who have access to the most sensitive information). There is also something called Clone phishing, where a legitimate, previously delivered email is copied, or ‘Cloned’ to create an almost identical email, which has the attachments and links stripped and changed for more malicious versions, this is then spoofed to look like the sender is a trusted source.
While phishing is targeted at multiple individuals, hoping at least a few respond, Spear phishing is where an attacker will target a specific person or business, usually in an attempt to gain valuable confidential information, or to install malware at the place of business, which will allow access to confidential files.
Spear Phishing Definition
Spear phishing can be defined as “ The fraudulent practice of sending emails pretending to be from a known or trusted sender in order to induce targeted individuals to reveal confidential information.” This is often done to target specific individuals and is a common form of the many phishing examples currently circulating the internet.
What is Spear Phishing?
The term ‘What is spear phishing’ is searched quite often by people attempting to gain a better understanding into what spear phishing is and how it works.
Spear phishing is usually accomplished by sending an email presented from a trusted source, which contains malicious hyperlinks to websites where virus’s and malware can infect your devices. Spear phishing emails may look like they are from the head of the organisation it is targeting, or may attempt to exploit a person’s trusting nature by offering a sad story which elicits an emotional response.
If an email is received and it looks to be illegitimate or suspicious, the best course of action is to contact the person directly they are claiming to be, this should be done either face to face or over the phone, as the attacker could manipulate the source of the email to look legitimate.
How Does Phishing Work?
So how does phishing work? This is done by appealing to the trusting nature of a person, making the phishing attack appear like an email from a trusted source and attempting to gain an emotional response from the recipient, this is done by including common issues such as a family member in distress, a notice of impending account closure if you don’t send certain information or even pretending to offer prizes for competitions you didn’t enter, all with the intention of targeting multiple recipients, knowing a small number are likely to fall for the scam.
What is Social Engineering?
Social Engineering can be defined as, the art of manipulating people in order to gain sensitive or confidential information. For example an attacker may call or email you and ask you to verify certain information, such as data protection questions (Mothers maiden name, address, last 3 digits on the back of your bank card, passwords or a memorable place,), this information can then be used by the attacker to gain more information about you from other sources.
Once an attacker has gained some information about you, it becomes much easier for them to infiltrate your life, such as calling your bank and attempting to verify themselves as you with your mother’s maiden name, password or memorable place.
A Social Engineering attack could come in many forms, this could be an email pretending to be someone you know, or a trusted online retailer, they could even come in the form of a response, pretending to answer an ad or question that you never even asked. This is done to play on the possibility of having an issue in the first place, it could be computer help ‘Click here for the answer to your computer problem’ which will contain a malicious link, or an email from a bank you aren’t with, trying to gain confidential banking information.
Action Fraud Phishing
Some phishing emails may claim to be from HMRC and even reference their own Action Fraud contact information to report suspicious emails or action fraud phishing attempts, these can be spotted by checking for grammatical and spelling errors, or looking to see if they request any personal or confidential information.
Any legitimate source would use a clear proof read process to ensure all emails and messages would have been checked thoroughly for quality purposes and would never ask for any personal or confidential information.
Some malicious emails may look like they have come from a trusted online retailer, these could be in the form of Amazon phishing emails, which may include information about a purchase you haven’t made, in an attempt to get the recipient to click on a malicious hyperlink. This hyperlink would then send the recipient to a website which would log the username and password of the target, allowing the attacker to see names, addresses, card details and security information, which could later be used against them.
Some Amazon phishing emails may request account information or try to verify security questions and passwords, these should never be trusted, as a genuine email would never ask for account information or anything confidential. An easy way to test any email, would be to go directly to the retailers website, using a browser, and verifying the website does what whatever information the email is requesting, never click on any links in an email that is not trusted.
Barclays Fraud Email
A common phishing attack, is a phishing email that is circulating, is emails pretending to be from banks, for example, the Barclays Fraud Email, an email claiming to be from the Barclays fraud department, asking to verify information in order to prevent restrictions or accounts being frozen.
Any email from a trusted source will never request account information, credentials or verification of security details, this should be done over a secure environment, not through an unsecured email. Many banks have already released statements asking customers to never respond to emails or open attachments or links, that are requesting personal or banking information, as these are almost certainly fraudulent.
BT Phishing Email
Phishing emails which are made to look like those from Telecommunications companies, such as BT, these come in the form of BT phishing emails and are being used to target customers with the intent on getting targets to divulge sensitive information about their accounts, or banking information, these emails often contain links to ‘Password reset’ pages and will instead redirect the user to a malicious page which could infect the targets device with malware.
Any email from BT or any other telecommunications company, will never include statements which ask for sensitive information, and will usually be well written and contain no grammatical or spelling errors, BT phishing emails, or any other suspicious emails, should be reported to the trusted vendor, using their websites fraudulent email page.
Fake Invoice Email
Fake invoice emails can come in the form of phishing emails which contain attachments, often claiming to be from online retailer, often containing invoices, these lead the recipient into believing they have made a purchase or their account has already been compromised, these attachments are often malicious and contain malware, which runs on the targets device when opened. Any and all emails from untrusted sources should be ignored and any attachments should never be opened.
Fake invoice emails could appear to come from any source, such as PayPal, Amazon or Apple, the invoice will show information such as music, apps, or products from the retailer, which have apparently been purchased. The idea is to invoke a quick, emotional response, from the target and make them believe someone has bought something using their account, this would provoke the recipient into clicking on a malicious link, and divulging personal or account information without realising.