Phishing

Phishing represents the fraudulent acquisition of personal and financial information like credit card information and passwords.

The theft of financial and personal data is achieved through deceptive means such as fraudulent emails and copies of legitimate websites. Brand spoofing and carding are forms of phishing.

Spear Phishing

Spear phishing is a type of phishing attack that targets specific individuals or organizations through malicious emails in order to steal sensitive information like login credentials or to infect the targets’ device with malware. The attack appears to be from trusted senders and it uses social engineering techniques to urge the victim to click on a malicious link or attachment. Whereas phishing attacks, in general, prioritize quantity, spear phishing prioritizes quantity. In that same vein, a whaling attack prioritizes C-level targets within an organization.

Phishing History

Phishing scams first appeared during the 1990s on AOL. Emails that appeared to come from AOL but were actually from a hacker who requested users to update their personal and financial information via email, causing many people to expose their information, which was then abused by the hacker. The problem was that at that time AOL permitted the creation of a fake account by means of a credit card generator, but after these attacks AOL had to change this technique.

Phishing attacks expanded quickly with the use of PayPal and other such organizations and websites using online payments. These attacks motivated the creation of secure payment applications. The term "phishing" was coined in 1996, and hacked accounts were known as "phish".

Cybersquatting

According to The Anti-Phishing Working Group, the number of cybersquatted domain names used in conjunction with phishing fell to only 2% of attacks in 2012. A report identified 64,204 phishing domains in total, of which only 12% is suspected by APWG as being registered by the phishers. The rest were compromised accounts owned by third parties. More than half of phisher-owned domains were in .tk, a registry that offers free registration.

Combating Phishing with Next Generation Passwordless Authentication

"WinMagic's MagicEndpoint Passwordless Multifactor Authentication will ensure your systems are secure and easy to access. Turn regular devices into security keys.

Types of Phishing Practices

Phishing involves the following:

• The possibility of introducing a virus attack
• The development of a legitimate website copy
• Session Hijacking
• Fooling Internet users to submit financial and personal data or passwords
• Emails that claim to be sent on behalf of well-known organizations
• Data Theft
• DNS-Based Phishing also referred to as "Pharming"
• Voice phishing, which is a rather new form of phishing: users will receive an email allegedly from their favorite websites and will be requested to call a fraudulent number and update their information, which will then be stolen by the hacker.
• Tabnabbing, which takes advantage of multiple tabs that Internet users may frequently use and redirects the Internet user to the wrong website.
• Pop-up windows which may appear from legitimate and original websites but request financial and credential information.

Protection against Phishing Practices

In order to avoid being a victim of phishing, Internet users should take the following into consideration:

1. Avoid or delete mass emails
2. Install anti-phishing software
3. Avoid password authentication services
4. Ignore emails requesting financial information updates
5. Use spam filters to eliminate phishing emails. This solution relies on natural language processing methods and is able to substantially reduce the number of phishing emails.
6. Do not trust impersonal emails
7. Be suspicious regarding email links
8. Submit credit card information only on secure websites with secure payment options.

Trajectories

In the early 2020s, phishing began growing in popularity among threat actors even as DNS Abuse in general appeared to trend down.

On July 19, 2022, Interisle Consulting reported that:

• phishing attacks were up by 61 % over the previous year,
• phishing reporting went up by 72 %,
• 76% of domains for phishing were registered with nTLDs (34% were split between .com and .net,
• phishers are targeting big tech brands, and
• cryptocurrency phishing increased by 257 %.