Phishing attempts are no longer the simple quantity over quality attacks that they used to be. More and more often, attackers are taking the time to carefully research their targets, and build convincing sites, in the hopes of getting people to accidentally hand out their credentials, according to an article in ZDNet. That research can take the form of mining information from publicly available sources like social media profiles, or by direct contact with people via faked social media profiles of third parties. Either way, the intent is the same — to build up an understanding of the target, and use that understanding to trick them. For many phishing attempts, the ultimate goal is credentials for corporate accounts, as these credentials can help hackers to get around many other cybersecurity controls and directly access networks.
The process for these targeted attacks can be a slow one, according to ZDNet, building up over time from an initial contact on a topic believed to be of interest to the recipient, followed by additional emails to build trust. Only after that trust is built or a relationship otherwise established will the phisher move on to sending a malicious link intended to allow for the harvesting of logins, passwords, and other access-related information. From that point, the hacker should have everything they need to cause havoc.
While not perfect, one action people can take to help protect themselves is the use of multi-factor authentication, where available. Intended to require a second (or third) piece of information to gain access to accounts, it can help provide warnings to people of unauthorized access attempts, and give them notice that their passwords may not be secure.
Source:
