Cyber criminals prefer the popular messaging app to more traditional emails to spread fake links and lead to termite phishing attacks. Why this choice?

phishingThanks to the evolution of the use of technologies, hackers are always the first in adopting the best solutions to achieve their goals. Thus, if internet connections today occur mainly via smartphones, it follows that more and more people use messaging apps, and above all the famous WathsApp, which records 89% of all phishing attacks recorded in the first six months of 2021. This was revealed by Kaspersky, a company that deals with computer security and which has analyzed this type of attack in recent months, highlighting that e-mail is no longer the preferred tool for the spread of phishing attacks but precisely WathsApp. Much less affected by the phenomenon are other apps such as Telegram and Viber.

What is phishing?

Phishing is a technique with which a landing page is created, reachable via a special link, which contains the logo, texts and graphics of an official page of a credit institution or an e-commerce site, for example. In practice, an official page is reproduced, as faithfully as possible, requesting access credentials and bank details. In this way, cybercriminals can steal user credentials or receive payments, which of course, will never reach the real seller.

It is generally based on social engineering techniques: lots of e-mails are sent that mimic those of the most popular service providers, so that in the number there is certainly someone who is actually a customer of that specific company. Trusting the apparent credibility given by the use of the logo and the official colors, the user clicks on the link and, convinced that he is doing the right thing, enters his data. But on a portal that is not what it appears to be.

A survey carried out two years ago showed that only 17% of respondents were able to identify a phishing technique. This is why it is so successful, and has gone from 173,063 attacks in 2005 to nearly 500,000 attacks in 2019.

Types of phishing attacks

There are different types of attacks based on this technique, let's see the main ones.
 
Spear phishing, which targets a specific group of users, such as system administrators.
Whaling, which targets CEOs or executives.
Smishing, which consists in sending text messages to a mobile phone containing a link to a fake page. Normally it simulates sms coming from the bank.
Phishing by e-mail, used for many years, still manages to make victims today.
Phishing through search engines, which consists in using SEO techniques to push scam web pages among the top positions of search engines that lead to enter personal data and login credentials, often similar to the original ones.
 

How to defend against phishing attacks?

A livello aziendale esistono soluzioni di sicurezza e percorsi di formazione e sensibilizzazione specifica capaci di ridurre il rischio derivante dal comportamento troppo ingenuo degli operatori, come la soluzione di Proofpoint della quale parliamo a questo link. Ma un accorgimento che tutti dovrebbero adottare è quello di soffermarsi a leggere con attenzione il messaggio e soprattutto il link. Appare evidente che non può essere copiato perfettamente il dominio, pertanto quello fasullo ha sempre anche solo una lettera diversa, l'aggiunta di un numero o un'estensione diversa da quella ufficiale. Anche il testo stesso del messaggio spesso presenta errori grammaticali, a volte anche molto grossolani. Se il messaggio arriva dalla banca o richiede credenziali bancarie, è sempre meglio contattare direttamente la banca, evitando di cliccare su qualsiasi link.

Miki G.
Author: Miki G.
Web Content Editor
Owner of Web Idea, web analyst and communication professional with over 15 years of experience in projects related to cyber security and business risk analysis in relation to digitization, reputation management on the web, online marketing, copywriting, project and public coordination relationships, design and creation of websites.
Latest articles

Partner