In a recent article by global US-based consulting firm Deloitte, “91% of all cyber attacks originate from an email phishing scam.”
Hackers, phishing scammers, and cybercriminals continue to use email phishing as a primary attack vector to deliver malicious payload filled with malware, leading to ransomware and other cyber attacks.
Individuals and organizations need to remain vigilant against future email phishing, especially ones powered by hacker-enabled artificial intelligence (AI) created messages.
What is a Phishing Email Attack?
In 2023 alone, according to the FBI’s multi-state information report, the agency continues to see email phishing as the number one attack vector against individuals and corporations. However, email phishing reports a much lower financial loss per attack than people losing from investment scams.
Hackers and scammers will leverage several types of phishing attack methods, including:
- Spear phishing. A suspicious email sent to a specific victim.
- Whaling phishing. An email sent to a particular executive or global leader.
- Clone phishing. An email containing stolen email content from a previous email.
- Angler phishing. A phishing email from someone pretending to be a customer service representative.
Many email phishing messages contain everything from a suspicious link redirecting the user to a cloned hacker site requesting a password change to a rogue QR code impersonating an Amazon return.
The National Cybersecurity Center (NCC) reported in their January 2023 article the growing danger of hackers and scammers manipulating QR codes on restaurant menus and retail locations while using rogue embedded images, redirecting victims to malware sites within email phishing attacks.
If the message looks fake, it probably is.
Embedded within suspicious activities often have an offer for money exchange for big profits, unclaimed inheritance, or an opportunity to purchase land in a foreign country. These messages often contain misspellings, poor grammar, sentence structure, and false facts.
Hackers will create a fake domain and malicious websites like aamazon-returns.com or Ggoogle-support.org to trick the users and many email filters, believing the sending domain is authentic and from a reputable company. Using these impostor domains, hackers will attempt everything from a fraud scheme to a business email compromise (BEC) against a business or try to extort money from a victim as part of a fake romantic scheme.
Read before you reply.
If a user receives a message from a long-lost friend from the 3rd grade with an urgent request, before answering, stop and ask yourself, “Did I know this person?” Often, just by taking a few moments to ponder a reply, users will notice several things, including misspellings or words or a fake email address within the message’s header. Users can pane their mouse to reveal the email address used by the scammer. If the email displayed looks like; “Jym [email protected],” there is a probability this is an email phishing attack.
Hint: Try loading FBI.com into an internet browser to validate if the domain is legitimate. Usually, these domains are fake or attempting to impersonate legitimate domains.
Be aware of too good to be true offers.
Hackers and scammers, thanks in part to AI-powered tools, including WormGPT and FraudGPT, extend the attacker’s ability to learn from their attacks and adjust the type of scam in real time while increasing their range of rogue message delivery.
Offers presented in a suspecting email with requests for bank account information, false legal wills sent from an email address in Nigeria, and threatening messages from the Internal Revenue Service (IRS) should all be phishing attacks.
Hint: The IRS never uses emails. They sent 100% of all correspondence through the regular mail system.
Hackers and scammers will send billions of email scam messages globally daily, hoping that some victims will read the phishing messages, click on the malicious links, and reply to their fraudulent offers.
An example of an email phishing attempt embedded with a too-good-to-be-true lure:
“From Legal Guardian LLP – Lagos Nigeria,”
“To: [email protected]” (Broad-based message designed to capture anyone with this email address)”
Subject: Unclaimed Inheritance- Urgent!
“Good morning, my freind (misspelled and a generic greeting),
I have good news for you! Your uncle left you a considerable amount of money, close to 100 million (misspelled) pounds(Not in US Dollars). Our firm will help legally transfer these funds to your financial institution. Please click the link below and give us your bank details, social security number, and home address.
https://banking-africa.com/nigeria/law/cust.html (rogue domain and a malicious link pointing to a phishing site.)
You have 24 hours from receiving my message to reply, or the funds will go to another relative. (Many scammers will apply pressure and a high sense of urgency on the victim to act quickly.)
Signed,
Felix Addul – Partner (Fake name).”
Sadly, many people will click on the links in emails and surrender their financial account information and personal details, hoping to receive these funds.
What are the best ways to protect yourself against Phishing Attacks?
Technology alone does not stop email phishing attacks from happening or causing financial or emotional damage to their victims.
Users have several security awareness steps, including updating protection tools and other techniques to help protect themselves against these attacks. A critical step users must implement is constantly updating the antivirus software, anti-malware, and anti-phishing protection tools. Users must ensure these programs running on their various devices keep up-to-date with the latest security patches to help stop these attack vectors.
Call to action
The risk of phishing attacks will continue to be a global problem as more hackers and scammers leverage AI tools to create near-perfect phishing messages. These AI-enabled pose a considerable risk because they develop messages with little or no grammar or dialect issues. Users should report phishing attempts to the FBI Internet Crime Compliant Center(IC3).
Remember, if the message is too good to be true, it probably isn’t.
Best VPN deals this week:
