A cybercriminal is just one phishing email away from gaining unfettered access to your device, network, and valuable data. Phishing emails hold the potential to bypass many of the cybersecurity defenses employed by organizations and wreak havoc on the sensitive data and resources they hold. As concluded by PhishMe research, 91% of the time, phishing emails are behind successful cyber attacks.
PhishMe came to this conclusion after sending 40 million simulated phishing emails to around 1000 organizations. PhishMe’s study also found the healthcare sector to be particularly at risk of compromise via phishing attacks, with a phishing email response rate of 31% amongst healthcare employees, despite having received security awareness training.
How phishing attacks work
Cybercriminals have a wide variety of social engineering techniques at their disposal to lure the user into clicking on links, opening attachments, or disclosing sensitive information. Common tactics include:
- Impersonating trusted brands or individuals
- Creating spoofed websites
- Personalizing attacks using private details
Phishing can come in the shape of phony confirmation emails for online purchases, job applications, failed delivery notifications, security updates, and even legal notices, each designed to create urgency or fear.
Phishing doesn’t need to be sophisticated to work
But it doesn’t take a highly targeted or nuanced phishing attack (often called “spear phishing”) to be successful. PhishMe also discovered that employees even respond to the most basic forms of phishing emails too, which are usually far more generic and contain harmful links and attachments.
Example of a real-world phishing attack
Tech giant Google was recently in the crosshairs of a sophisticated phishing scheme which targeted the company’s approximately 1 billion Gmail users globally, in pursuit of acquiring access to users’ accounts and spreading to their contacts.
The emails closely mimiced real emails from Google and appeared to be sent by targets’ trusted contacts, asking recipients to open a linked “Google Docs” file. Once clicked, the link redirected users to Google’s actual account management page, where users were requested to give permission for a fake app, posing as the actual Google Docs, to access and manage their accounts.
Once granted access, the attackers would send the phishing email to the user's contact list, spreading the attack in an attempt to compromise as many users and as quickly as possible.
We are investigating a phishing email that appears as Google Docs. We encourage you to not click through & report as phishing within Gmail.
— Google Docs (@googledocs) May 3, 2017
While similar Google Docs phishing scams have been taking place for years, this campaign proved highly successful due to its convincing use of Google’s branding and email format as well as its propagation techniques.
How to avoid phishing attacks
Be cautious with unexpected messages
Inspect links and domains before clicking
Verify requests independently
Watch for advanced phishing tactics
Use strong authentication controls
Secure your connections and devices
Consider anti-phishing tools
For more tips on protecting against phishing attacks, check out Fortra's infographic, Don't Get Hooked: How to Recognize and Avoid Phishing Attacks.
Anas Baig is a cybersecurity journalist who covers cybersecurity and tech news. He is a computer science graduate specializing in internet security, science and technology. He is also a security professional with a passion for robots and IoT devices. Follow him on Twitter @anasbaigdm.