Phishing is a cyberattack where attackers use fake messages or websites to trick victims into giving away sensitive information. It works like “fishing,” using bait to lure targets into clicking harmful links or entering confidential data.
- Aims to steal sensitive information such as user credentials, credit card details, government identification numbers and personal data by impersonating trusted organizations or online services.
- Commonly delivered through fraudulent emails, messages or spoofed websites that closely resemble legitimate platforms but use deceptive or suspicious URLs to trick users.
Methods Used to Carry Out Phishing
Phishing can occur in several ways. Any of the methods below can lead a user into a phishing attack:
- Clicking on an Unknown File or Attachment: Opening malicious attachments can execute malware, exploit vulnerabilities or initiate credential theft attacks.
- Using an Open or Free Wi-Fi Hotspot: Unsecured Wi-Fi networks enable attackers to perform packet sniffing, man-in-the-middle (MITM) and session hijacking attacks.
- Responding to Social Media Requests: Attackers use social engineering and OSINT techniques to harvest personal information and establish trust for targeted attacks.
- Clicking on Unauthenticated Links or Ads: Malicious links can lead to phishing websites, drive-by downloads or credential harvesting platforms.
Types of Phishing Attacks
1. Email Phishing
Attackers send fake emails pretending to be trusted organizations to steal sensitive information.
- Often request login credentials, banking details or personal information. May include malicious links or infected attachments.
- Example: An email claiming to be from a bank asks the user to verify account details through a fake website.
2. Spear Phishing
A targeted phishing attack aimed at a specific individual or organization.
- Uses personal or professional information to appear legitimate. Messages are customized to increase credibility.
- Example: An employee receives an email appearing to be from their manager requesting access to a confidential document.
3. Whaling
A phishing attack specifically targeting senior executives and decision-makers.
- Focuses on CEOs, CFOs, directors and other high-ranking officials. Often involves requests for sensitive data or financial transactions.
- Example: A CFO receives an email impersonating the CEO requesting an urgent wire transfer.
4. Smishing
Phishing conducted through SMS or text messages.
- Contains fraudulent links or fake alerts. Attempts to steal credentials, OTPs or financial information.
- Example: A text message claiming a package delivery issue asks the user to click a malicious tracking link.
5. Vishing
Phishing performed through voice calls.
- Attackers impersonate banks, government agencies or technical support. Victims are persuaded to reveal confidential information.
- Example: A caller pretending to be a bank representative asks for an OTP to "verify" an account.
6. Clone Phishing
Attackers copy a legitimate email and replace its links or attachments with malicious ones.
- The cloned email closely resembles the original message. Victims trust the email because it appears familiar.
- Example: A previously received company invoice is resent with a malicious attachment disguised as an updated document.
Preventive Measures for Phishing
Users can avoid phishing by following these precautions:
- Authorized Sources: Download software only from trusted platforms.
- Confidentiality: Never share private details with unknown links or websites.
- Check URLs: Verify website addresses to avoid fake sites.
- Avoid replying to suspicious emails: Contact the sender through a fresh email if unsure.
- Use phishing detection tools: These help identify malicious websites.
- Avoid free Wi-Fi: Public hotspots may expose sensitive data.
- Keep your system updated: Updates patch vulnerabilities.
- Enable firewalls: Firewalls filter suspicious traffic.
Distinguishing Between Fake Website and Real Website
Here are ways to identify legitimate websites:
1. Check the URL of the Website
- A good and legal website always uses a secure medium to protect yourself from online threats.
- That means if a website is started with https:// then the website is secure because https:// "s" denotes secure, which means the website uses encryption to transfer data, protecting it from hackers.
- If a website uses http:// then the website is not guaranteed to be safe.
- So, it is advised not to visit HTTP websites as they are not secure.
2. Check the Domain Name
- The attackers generally create a website whose address mimics large brands or companies like geeksforgeeks.org/course_id=23.
- If we look closely, we can see that it's a fake website as the spelling of GeeksforGeeks is wrong, that is geeksforgeeks is written.
3. Analyze the Site Design
- If you open a website from the link, then pay attention to the design of the site.
- Although the attacker tries to imitate the original one as much as possible, they still lack in some places.
- So, if you see something off, then that might be a sign of a fake website.
- Example: www.sugarcube.com/facebook, when we open this URL the page open is cloned to the actual Facebook page but it is a fake website. The original link to Facebook is www.facebook.com.
Anti-Phishing Tools
- Anti-Phishing Domain Advisor (APDA): Warns users about phishing websites with real-time alerts.
- PhishTank: A community-driven database of reported phishing sites.
- Webroot Anti-Phishing: Uses machine learning to detect suspicious websites.
- Malwarebytes Anti-Phishing: Blocks malicious websites using real-time detection.
- Kaspersky Anti-Phishing: Provides integrated protection using known phishing database lists.
Note: Anti-phishing tools help add protection but are not a complete solution. Users must remain cautious and practice safe browsing habits to avoid falling victim.