Cyber criminals prefer the popular messaging app to more traditional emails to spread fake links and lead to termite phishing attacks. Why this choice?
Thanks to the evolution of the use of technologies, hackers are always the first in adopting the best solutions to achieve their goals. Thus, if internet connections today occur mainly via smartphones, it follows that more and more people use messaging apps, and above all the famous WathsApp, which records 89% of all phishing attacks recorded in the first six months of 2021. This was revealed by Kaspersky, a company that deals with computer security and which has analyzed this type of attack in recent months, highlighting that e-mail is no longer the preferred tool for the spread of phishing attacks but precisely WathsApp. Much less affected by the phenomenon are other apps such as Telegram and Viber.
What is phishing?
Phishing is a technique with which a landing page is created, reachable via a special link, which contains the logo, texts and graphics of an official page of a credit institution or an e-commerce site, for example. In practice, an official page is reproduced, as faithfully as possible, requesting access credentials and bank details. In this way, cybercriminals can steal user credentials or receive payments, which of course, will never reach the real seller.
It is generally based on social engineering techniques: lots of e-mails are sent that mimic those of the most popular service providers, so that in the number there is certainly someone who is actually a customer of that specific company. Trusting the apparent credibility given by the use of the logo and the official colors, the user clicks on the link and, convinced that he is doing the right thing, enters his data. But on a portal that is not what it appears to be.
A survey carried out two years ago showed that only 17% of respondents were able to identify a phishing technique. This is why it is so successful, and has gone from 173,063 attacks in 2005 to nearly 500,000 attacks in 2019.
Types of phishing attacks
How to defend against phishing attacks?
A livello aziendale esistono soluzioni di sicurezza e percorsi di formazione e sensibilizzazione specifica capaci di ridurre il rischio derivante dal comportamento troppo ingenuo degli operatori, come la soluzione di Proofpoint della quale parliamo a questo link. Ma un accorgimento che tutti dovrebbero adottare è quello di soffermarsi a leggere con attenzione il messaggio e soprattutto il link. Appare evidente che non può essere copiato perfettamente il dominio, pertanto quello fasullo ha sempre anche solo una lettera diversa, l'aggiunta di un numero o un'estensione diversa da quella ufficiale. Anche il testo stesso del messaggio spesso presenta errori grammaticali, a volte anche molto grossolani. Se il messaggio arriva dalla banca o richiede credenziali bancarie, è sempre meglio contattare direttamente la banca, evitando di cliccare su qualsiasi link.
