Internet security specialists are fighting a constant battle to render systems impossible for cybercriminals to penetrate. As security solutions become more advanced, hackers have been forced to adopt new tactics and tricks to circumnavigate company defences. The following are three strategies to look for:
1. Message service attacks
While the typical format for phishing traditionally employs an email to deliver its malicious content or lure, many hackers have changed tack as providers like Microsoft and Google scan emails to identify suspect links. Phishing emails will either be moved directly to a user’s spam folder or flagged with a warning of their potential risk.
To bypass this security, cybercriminals have adopted phishing strategies that exploit messaging services commonly used by a company such as Facebook Messenger or Skype. If threat actors can steal credentials, they will be able to pose as a trusted source or team member, sending out malicious links. The users receiving messages recognise a familiar face of a colleague and are more likely to be fooled.
A virus spread using Facebook Messenger application is an infamous tactic used by cybercriminals. The malicious message delivers a short link and an interesting phrase that mentions the recipient, but if clicked on will take the user directly to a phishing site containing a wide range of dangerous content.
2. One-to-one phishing
This tactic uses direct interaction between a hacker and his target. The success of a phishing strategy ultimately relies on the user’s gullibility and one-to-one phishing enhances this technique using leaked data to create more believable and bespoke messages.
When the target responds to a message, the then hacker replies directly using exploited information to appear genuine. The cybercriminal then convinces their mark to hand over sensitive data, such as financial details.
An example of this strategy is when a hacker clones a trusted institution’s website and uses a live chat tool to get targets to visit the bogus site and harvest financial details like company credit card numbers. The tactic also works by phone, where hackers imitate colleagues or superiors to glean sensitive information.
3. Software as a Service (SaaS) strategies
Another form of phishing attempts to gain information less obvious than financial details, instead seeking to obtain usernames and passwords for SaaS products such as Dropbox, Slack and Google G-Suite. If such attempts are successful, the effects can have a devastating impact on businesses with cybercriminals accessing entire company email histories and databases. With this sensitive information in their possession, threat actors can widen an attack against an organisation.
This strategy commonly starts with a believable alert message that warns security has been penetrated on the target’s SaaS account. In order to fix this, the user must enter login credentials, which are then appropriated by the hacker.
Specialist support and protection
For comprehensive data protection and security advice, companies can depend on us at Galaxkey. From safeguarding emails and documents to helping colleagues collaborate securely, we specialise in ensuring businesses are in complete control of sensitive data. Contact our expert team today with your concerns and questions.
