The Most Effective Social Engineering Tool Used by Hackers

Be careful when opening a business email that looks almost-official, for it may not be quite what it seems. You have probably heard all about phishing – the number one social engineering trick used by hackers and scammers. “But what is spear phishing?”, you may ask, and what is the difference? 

Well, put simply, spear phishing is a more personalised form of phishing. It’s a sign that the hacker or scammer knows you or your business, and quite badly wants in. With regular phishing attacks, you may be able to tell something is off. Say you receive a business email riddled with grammatical errors, from a sketchy email address; chances are a lot of your employees, and a lot of other similar sized businesses received the same email. Phishing attacks are usually broad and unspecific to attract the most clicks they can. 

Spear phishing is dangerous for the opposite reason. Chances are when you receive a spear phishing link, you are among the chosen few. Because of this, the scammer puts a lot more work in to make sure you click that link. 

Why is spear phishing so effective? 

The problem with spear phishing is that it is designed to not be figured out. Regular phishing attacks usually go for broad appeal, sending out messages about resetting passwords or software updates that link to a page that will download malware or steal data that is willingly put in by the scammer. Since these attacks don’t often work on the tech-literate, spear phishers up the game. 

Spear phishing attacks often look genuine and come from an email address that looks corporate or official. For example, you may receive an email that looks like it is from an organisation you recently did business with telling you to sign up for an account on their service, or pay a service fee. Spear phishers often rely on data they have previously stolen or accessed to personalise the emails they send out. 

Once the spear phisher has landed a catch, they can cause a lot of harm to your business, depending on the form of phishing attack. Spear phishing can be used to scam businesses out of money, or to compromise security by having the victim install malware, which can lead to data breaches, computer viruses, or ransomware attacks. 

Whaling 

Whaling is an extended form of spear phishing, whereby the attacker will target higher-ups in a business such as a CEO or an executive. Whaling attacks usually take place over longer periods of time, with more investment and research done to design a believable and effective scam. The damage done by a whaling attack can be devastating, however most whalers look for money in their scams, as higher-level executives are more likely to have access to a business’s capital. 

Identifying spear phishing attacks 

As stated, spear phishing attacks often look like regular emails, so it is intentionally difficult to tell the difference. There are some tell-tale signs that you can look out for at first to try weed out the bad actors. 

• Double check the email address of the sender In effective spear phishing attacks, the scammer will try to use an email address and name that closely resembles one that of an actual person you have corresponded with. Should you receive an email that asks for direct payment or for you to download something externally, always check the sender’s information. 
• Scan email attachments Many good spear phishers will find a way to upload malware attachments to an email disguised as a legitimate file. Many will even go out their way to bypass email security measures, so it’s important to stay on guard. Some websites and security solutions will allow you to scan an attachment to verify it. This is especially necessary for outdated word document files, pdfs, or jpegs, as they can be injected with malicious code. 
• Never use business login details outside the business network A lot of spear phishing attempts will try to snatch business login details by having the victim log in to a fake website. If you click on a link that takes you out of the business’s intranet, do not use your work information before verifying the website’s legitimacy. 
• Verify important looking emails If you still have doubts after identifying an email as best you can, it may be worth calling the business directly to verify the email is legitimate. Also, be wary if the email is unsolicited, as spear phishing emails often are. 

Mitigating the effects of spear phishing 

While spear phishing can be prevented in some cases, the goal of an attack is to take advantage of someone who may not have the time to rigorously check emails they receive. Mistakes can be made, and in the case you or someone in your business falls victim to spear phishing, it’s important to know how to mitigate the damage. 

• Email security solutions Having good email security set up can help filter out general phishing attacks, as well as quarantine the unsafe attachments sent by spear phishers. 
• DNS filtering DNS filtering solutions can help identify suspicious web links sent by spear phishers and prevent access. 
• Malware protection Anti-malware services will often be aware of a file that is making the rounds in spear phishing attacks. A malware protection solution will help stop malicious programs downloaded from spear phishing attacks from infecting your computer or network. 
• Password security Having a strong business password policy can prevent spear phishers from using the information they gather. Using a password manager can prevent you from accidentally giving away your information, and changing passwords regularly can lower the time a phisher has access to your network if they do happen to steal your information. 
• Multi-factor authentication (MFA) Very much an extension of password security, having MFA measures in place in your business’s network will help prevent spear phishers accessing important business data. Make sure important data is locked behind some form of MFA, for example an SMS token, or a physical magnetic stripe card. 

How can Securiwiser help? 

Securiwiser can help prevent your business becoming the target of cybercrime. Securiwiser is an online cybersecurity evaluation tool that will provide a real-time analysis of your organisation’s cybersecurity profile. 

You can check the strength of your organisation’s cybersecurity via a robust rating system that covers DNS health, email security, network security, and more. Securiwiser will also provide you with detailed information on what you can do to improve your cybersecurity posture. 

Click here for a free cybersecurity report.