A GUIDE TO KEY PHISHING TRENDS TO LOOK OUT FOR

Phishing attacks aimed at stealing legitimate user credentials have been used in the past 2 years to compromise almost half of UK firms. The FBI has also recently reported worldwide losses of at least $26bn (£21bn) since 2016 for CEO Fraud; a scam in which cybercriminals spoof company email accounts to impersonate Executives and effectively trick employees into transferring money and sensitive information to them.

Here at Nasstar, we are seeing a considerable increase in these attack vectors. Many businesses have been affected, and many are oblivious to the fact that they’ve already been breached. So, as attacks of this nature increase, we would like to keep you informed on the latest tactics that are emerging.

Key Phishing trends to look out for:

Phishing attacks targeting your SaaS credentials:

High-quality Phishing attacks have been simulating the emails we expect to see from our Office 365 and Google accounts, making it hard to know what we are receiving is genuine as attackers remain one step ahead in the cyber-security arms race.

Open Redirects:

One of the latest cyber-security scams to be vigilant of; Open Redirects, refers to a URL that can appear as one thing at first glance, but upon careful inspection redirects users to a malicious site. This illegitimate website will then capture credentials and infect your machine with malware. Attackers are using well-known names such as Adobe and Google to facilitate these attacks - so watch out!

Phishing attacks sent through messaging apps:

We are starting to see an increase in attacks via non-email platforms. Slack, Teams, Facebook Messenger and other communication apps have become popular vectors for Phishing, and whilst there is a lot of communication in the marketplace encouraging users to be wary of clicking on email-based links, users are less vigilant using these tools. Interestingly, these messaging platforms often do not have the same built-in security measures as email such as link scanning and malware detection, so the odds of a security threat reaching you are much higher.

Simple steps to protect your organisation:

• User awareness training
• Office 365 Hardening
• Display name spoofing protection for key individuals in your organisation
• Multi-factor authentication
• Review and control your email rules
• Set up email alerting when non-BAU activity occurs

The security partner of choice

If you’d like more information on how to protect your security posture, Nasstar is here to help. Nasstar’s Cyber Security as a Service portfolio is unique in the marketplace as our services are individually tailored to suit your requirements, leaving you confident that your infrastructure is in the reliable hands of a firm that truly understands your business.

If you’d like a complimentary consultation to talk about your security requirements, or would like to learn more, please contact us here