{"id":109200,"date":"2024-04-19T09:13:45","date_gmt":"2024-04-19T13:13:45","guid":{"rendered":"https:\/\/jumpcloud.com\/?p=109200"},"modified":"2024-11-05T17:45:09","modified_gmt":"2024-11-05T22:45:09","slug":"modern-phishing","status":"publish","type":"post","link":"https:\/\/jumpcloud.com\/blog\/modern-phishing","title":{"rendered":"How to Defend Against Modern Phishing Attacks"},"content":{"rendered":"\n
Phishing isn\u2019t what it used to be. Older, popular scams \u2014 like grammatically incorrect love letters and mysterious princes who just need a little money \u2014 have given way to sophisticated and dangerous social engineering attacks. In fact, phishing has become so prevalent and effective that it is one of the three primary ways<\/a> hackers compromise credentials. <\/p>\n\n\n\n Fortunately, there are policies and controls that IT administrators can put in place to minimize the threat and consequences of phishing attacks. This article will cover modern phishing, including what it looks like today, how employees should respond to suspected phishing attempts, and how you can help prevent phishing in your organization. <\/p>\n\n\n\n Phishing is a social engineering attack vector where bad actors impersonate reputable sources to trick users into compromising their credentials or downloading malware. It\u2019s an attack vector that preys on human nature and is relatively low-cost and low-effort to execute. This unique combination makes phishing particularly prevalent and dangerous.<\/p>\n\n\n\n While phishing became infamous in the \u02bc90s through clearly fraudulent emails with poor grammar, attacks have become much more sophisticated and diverse. We\u2019ll cover some of these emerging tactics here.<\/p>\n\n\n\n Understanding phishing attack types will prepare you and your users to spot them. The first phishing email was sent in the mid-1990s<\/a>, when attackers posed as AOL employees to steal credentials via AOL messages and email. This traditional tactic remains in use today, largely for widespread, untargeted attacks. <\/p>\n\n\n\n Other, more targeted phishing styles have evolved as well. The following are some of the most common:<\/p>\n\n\n\n Email phishing is the most standard form of phishing, which most users are likely familiar with. In a phishing email, a hacker sends an email posing as someone trustworthy to convince the recipient to click a malicious link, download malware, or hand over their credentials. <\/p>\n\n\n\n Smishing (SMS phishing) is similar to email phishing, but it occurs over text. <\/p>\n\n\n\n Vishing is also a variant of email phishing that occurs via voice\/phone call.<\/p>\n\n\n\n Spear-phishing takes the traditional phishing email and personalizes it with social engineering, targeting a specific individual. This tactic takes hackers longer to execute, but it is generally more convincing than a standard phishing attempt. Because of the extra time investment, spear-phishing attacks usually target higher-value targets with deep levels of access.<\/p>\n\n\n\n Whaling uses the same tactics as spear-phishing, but it targets senior-level personnel. It\u2019s important for executives to be aware of whaling and understand they aren\u2019t immune to attack. Make sure they take part in any phishing awareness training you implement.<\/p>\n\n\n\n Clone phishing swaps real links or attachments for malicious ones in a legitimate, previously sent email, and then resends it. Often, phishers use an email that was sent to a group, and resend the email to the group. If they have access to the sender\u2019s email account, they may send it from that account under the premise of resending with updated information. <\/p>\n\n\n\n Hackers are always looking for new ways to reach their targets, and Google searches are now within their arsenal. In search engine phishing, hackers forge a legitimate website and optimize it to show up for a common Google search. If they design it correctly, it can be difficult to spot the site as a fake. Hackers usually do this with account pages, hoping users visit the page and input their credentials, unknowingly giving them away.<\/p>\n\n\n\n Now that we\u2019ve established popular types of phishing attacks, it\u2019s important for users to understand who phishers might impersonate. This is critical information for the end-user, who needs to know what a phishing email might look like when it pops up in their inbox. <\/p>\n\n\n\n Phishers often impersonate brands that use online accounts, like subscription services, banks, credit card companies, and software. Under the guise of a familiar brand, they\u2019ll email customers claiming that their account is locked, set to expire, needs review \u2014 anything to get them to open the link and log in. The recipients who follow the link will usually land on a fake login page that captures and exploits their credentials.<\/p>\n\n\n\n If your boss said they urgently needed your help with something, would you say no? <\/p>\n\n\n\n Many phishers bet on employees trusting their leaders. They\u2019ll trick employees into clicking a link or sharing credentials by impersonating the employee\u2019s boss and making an urgent request, usually via text or email. When the phisher does their research on their target, these attacks can often be quite convincing. <\/p>\n\n\n\n This ruse doesn\u2019t stop at direct superiors. HR personnel, IT admins, and fellow coworkers are other people phishers impersonate to trick employees into cooperating with an ask. <\/p>\n\n\n\n Customers wanting to pay for your company\u2019s services seem pretty routine, which is why this phishing method works. In these attacks, phishers email you as a \u201ccustomer,\u201d claiming that they\u2019ve attached their payment. (Spoiler alert: the attachment isn\u2019t their payment. It\u2019s likely malware.)<\/p>\n\n\n\n Legal action can scare anyone, even if they haven\u2019t done anything wrong. That\u2019s the thinking behind these attacks, which pose as a government body threatening legal fees, jail time, or other penalties unless the recipient takes action. That action is usually remitting payment or clicking a malicious link, downloading malware.<\/p>\n\n\n\n Social media and remote work have eliminated the discomfort of meeting someone virtually. Phishers are exploiting this phenomenon by impersonating your connections. They\u2019ll find a person, company, club, or other connection in your social media and use it to establish common ground. After they\u2019ve established trust, they\u2019ll try to get you to click a link or share information with them. <\/p>\n\n\n\n When executed correctly, these phishing attacks are some of the most convincing and dangerous. This attack is often the tactic spear-phishers and whalers use, doing their research and targeting someone high up to make their attack count. <\/p>\n\n\n\n While grammar and believability used to be a primary factor in catching phishing attempts, they\u2019ve become much more sophisticated. Many no longer contain these mistakes, and they shouldn\u2019t be employees\u2019 sole tip-offs.<\/p>\n\n\n\n Employees should learn to look for context clues when they are asked to click a link, download something, log into an account, or share information, assets, or money. Common context clues that could tip someone off to a phishing attempt include: <\/p>\n\n\n\n When in doubt, users should check with the sender on another channel to confirm that they sent the message. For senders in the organization, a quick chat will often suffice; for companies, contacting customer service, using their chat bot, or emailing an account representative are common methods. (Note: don\u2019t use contact information listed in a suspected phishing email; visit the company\u2019s website manually to find contact info.) <\/p>\n\n\n\n Instead of clicking a link, users should type in the URL manually. This will prevent them from clicking on a malicious site with a URL that uses an \u201co\u201d instead of a \u201c0.\u201d This also goes for email addresses and phone numbers if you reply to a message: type them in manually instead of replying within the thread.<\/p>\n\n\n\n This is especially true when logging in or changing a password: never do so through an email or other indirect channel. Users should only ever type in credentials when on a website they trust and can validate it is the real thing, and never in an email. Ideally, your users can change their password on their machine<\/a> (a safe place to change that password) and have it propagated to their other services.<\/p>\n\n\n\n Phishing emails usually make a claim \u2014 users should check those claims\u2019 legitimacy if they can. For example, if an email claims that a user\u2019s account is locked out, they could try logging into the account in a separate browser. Phishers can\u2019t control the context clues around them, and real-life deduction can often outwit a phishing attempt.<\/p>\n\n\n\n If users can\u2019t confirm a message\u2019s legitimacy, they should never interact with it. This includes replying, clicking anything, and opening attachments. <\/p>\n\n\n\n When users suspect phishing, they should have a clear set of steps to follow. Usually, this is reporting it to their IT or security team. Organizations often use a designated phishing reporting email address or require users to install a phishing reporting tool in their email. Make sure users know how to report it without interacting with it \u2014 for example, take a screenshot of a suspicious email rather than forwarding the email itself. <\/p>\n\n\n\n Phishing security relies on employees to stay vigilant and do their part. Your IT department should run regular training on phishing awareness that includes what phishing is, how to detect it, and how to appropriately respond to and report suspected phishing attempts. <\/p>\n\n\n\n Not sure where to start with training? Pull from this blog to create a guide!<\/em><\/strong><\/p>\n\n\n\n Consider running phishing simulation tests to gauge how well employees react to phishing. These tests send fake phishing emails to employees to see how they respond. They\u2019re usually conducted by a third party, and many services include reporting, periodic testing to gauge improvement, help with phishing awareness training, and recommendations for next steps. <\/p>\n\n\n\n A large portion of phishing attacks attempt to gain access to employees\u2019 passwords by tricking them into typing them into the wrong place. So, one of the best defenses against phishing is reducing your organization\u2019s reliance on passwords altogether. We\u2019ll cover three key ways to do this.<\/p>\n\n\n\n Single sign-on (SSO)<\/a> allows users to access many (ideally, all) resources with one set of trusted credentials. With a robust SSO solution, employees should only have to type in their credentials once to access everything they need to do their work. <\/p>\n\n\n\n SSO reduces the risk of phishing by reducing the frequency with which users have to input their credentials. Instead of signing into every resource manually \u2014 by typing in their password \u2014 they would typically only have to do so once per session.<\/p>\n\n\n\n After rolling out an SSO solution, most organizations immediately enforce MFA and password complexity requirements to ensure that the single password each employee uses is secure. <\/p>\n\n\n\n Multi-factor authentication (MFA)<\/a> reduces the risk of phishing by making the password less powerful for authentication. It does this by adding an additional layer to the typical username-password authentication method. With MFA in place, a compromised password does not<\/em> mean a compromised account. A bad actor could only make use of a compromised password if they also<\/em> had access to the second factor (like their device). <\/p>\n\n\n\n Because phishing preys on users by tricking them into giving away their credentials, the best way to reduce phishing risk is to remove the need for users to input those credentials. Passwordless authentication is the most effective way to accomplish this.<\/p>\n\n\n\n Passwordless authentication prevents phishing by bypassing password-based authentication altogether. JumpCloud Go\u2122<\/a>, for example, enables users to securely authenticate via their trusted device without typing in their password. It can act as a user\u2019s SSO login, so users can use a phishing-resistant passwordless login to reach all the resources they need to do their work. <\/p>\n\n\n\n The JumpCloud Directory Platform<\/a> integrates many security features that help protect against phishing, including: <\/p>\n\n\n\n Take the first step toward keeping your organization\u2019s resources safe from successful phishing attacks. Start your free trial<\/a> of JumpCloud\u2019s secure device and identity management solution today. <\/p>\n","protected":false},"excerpt":{"rendered":" Phishing has become more dangerous and effective than ever. Learn what modern phishing looks like and how to prevent it in your organization.<\/p>\n","protected":false},"author":144,"featured_media":101056,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_oasis_is_in_workflow":0,"_oasis_original":0,"_oasis_task_priority":"","inline_featured_image":false,"footnotes":""},"categories":[23],"tags":[],"collection":[2775],"platform":[],"funnel_stage":[3016],"coauthors":[2532],"acf":[],"yoast_head":"\nWhat Is Phishing?<\/h2>\n\n\n\n
Popular Types of Phishing <\/h2>\n\n\n\n
Email Phishing<\/h3>\n\n\n\n
Smishing<\/h3>\n\n\n\n
Vishing<\/h3>\n\n\n\n
Spear-Phishing<\/h3>\n\n\n\n
Whaling <\/h3>\n\n\n\n
Clone Phishing<\/h3>\n\n\n\n
Search Engine Phishing<\/h3>\n\n\n\n
Who Do Phishing Attackers Impersonate?<\/h2>\n\n\n\n
A Popular Account<\/h3>\n\n\n\n
Someone on the Inside<\/h3>\n\n\n\n
A Customer<\/h3>\n\n\n\n
The Government<\/h3>\n\n\n\n
A New Connection<\/h3>\n\n\n\n
How to Spot a Phishing Attempt <\/h2>\n\n\n\n
\n
How to Respond to Suspected Phishing<\/h2>\n\n\n\n
Try Another Channel<\/h3>\n\n\n\n
Go to the Source<\/h3>\n\n\n\n
Validate the Information<\/h3>\n\n\n\n
Never Interact with a Suspicious Message<\/h3>\n\n\n\n
Report It<\/h3>\n\n\n\n
How to Prevent Phishing<\/h2>\n\n\n\n
Conduct Regular Phishing Awareness Training<\/h3>\n\n\n\n
Run Phishing Simulations<\/h3>\n\n\n\n
Step Up Your Password Game<\/h3>\n\n\n\n
1. Single Sign-On<\/h4>\n\n\n\n
2. Multi-Factor Authentication<\/h4>\n\n\n\n
3. Passwordless Authentication<\/h4>\n\n\n\n
Reduce the Risk of Phishing Damage with JumpCloud<\/h2>\n\n\n\n
\n