Don’t let your company be the next target: find out how hackers are using trusted brands to hide their attempts to keep everybody alert and informed.
In most cases, companies are just a couple of clicks away from devastating, costly, and reputationally damaging data breaches. If you’re reading this, chances are you’ve probably experienced a phishing attempt at some point during your professional and personal life. A strange link, a weird email. We all have recognised it for what it was and deleted or disregarded it in the past.
Yet data breaches happen all the time and in fact. While it may seem like hacker attempts are obvious, The 2022 Verizon Data Investigations Report indicated that “82% of breaches involved the human element.” How does this happen? Well, it’s because the good hackers are typically hiding in plain sight.
Hacker are Increasingly Hiding Behind Popular, Established Brands
Hackers are inventing more sophisticated methods for luring people (often employees) into their phishing attempts.
One way hackers are trapping people is by impersonating popular brands that people interact with regularly, either professionally or personally.
Some of the most popular brands who are often impersonated are:
- PayPal
- Adobe
Methods and Tactics
Spam filters do their best to combat malicious links. Even common training teaches employees to “hover” over links to preview the destination link. However, hackers are combatting this by using a variation or extension of a domain such as google.com or paypal.com
By using variations of these domains (such as .live that is usually associated with Microsoft), hackers can successfully navigate spam filters and find their way into employee inboxes. Even if an employee takes the extra step to hover, they will likely trust a link that seems so recognisable.
How to Spot a Phishing Attempt
There’s a reason why companies like Google, Adobe, and Microsoft are so often impersonated. These sites allow for user generated content that still contains the brands identifying URL. For example, Adobe and Google drive let users (such as hackers) host their links or attachments to their site. Therefore, even hovering will still see drive.google or adobe.com in some part of the domain.
Hovering and spam filters alone are not enough. We recommend to always pay attention to context. Read the whole email – even if it’s from a brand whose emails you receive every day. In most circumstances, if an employee does click a malicious link, the malware will not begin immediately. The attack typically happens after an employee enters their credentials or downloads material. By reading the context of the email and understanding the point of the link from the get go, employees will be better prepared to spot malicious attempts even when they’re disguised under trusted brands.
Watch what you Click/Download
For organisations who want to avoid devastating data breaches, it’s crucial to create a cybersecurity awareness culture when it comes to email, communication, and device management. Fundamental to this culture is to remain vigilant when checking email. Don’t just click something because there’s a button, even if it’s from a trusted brand. If an email is requesting you to download something, ask yourself what is the purpose of this email/download?
Stop Data breaches Before they Happen with PhishNet
Staff who receive highly effective cybersecurity awareness training are better prepared to recognise and avoid the most serious threats.
PhishNet delivers engaging, highly effective and affordable cybersecurity awareness training to help businesses mitigate the risks of human error data breaches. Talk to PhishNet today to learn more.