What is phishing?

There are several different types of phishing, but generally speaking, this is a type of social engineering attack that cyber criminals use to manipulate you into giving up data and allowing access to sensitive information. The most common way they do this is through a malicious email, but there are many other different types of phishing as well, such as:

• Spear phishing 

• Smishing

• Vishing

• Business email compromise

The two most common ways in which cyber criminals use phishing is either by sending an email with a malicious link or one that has a malicious attachment within it. These items will normally have malware coded into them, so that once the user has clicked or downloaded the link or document, the hacker will be able to gain access to the network. These emails will have an attention-grabbing title or an attractive attachment name such as “invoice” to encourage urgency for you to click on it. 

Sometimes emails like this may appear in your junk or spam folder, but smarter criminals are able to use their knowledge to trick the server into believing this is a genuine email. This means you may find it in your inbox. To help you out further, we take a look at our post on how to tell the difference between spam and phishing to help you identify what a risk is and what is just plain junk mail.

There are several types of malicious websites that could be linked to phishing attacks. Here are the most common types of phishing websites and how they manipulate you into thinking it’s an official site.

Pharming/DNS cache poisoning

This type of phishing attack redirects a website’s traffic to a malicious site impersonating the original location. It does this by exploiting vulnerabilities in the system that matches domain names with IP addresses. 

Clickjacking/ UI interface redressing/iframe overlay

This type of phishing involves the hackers applying several transparent layers over legitimate buttons and links. This means that a user may believe they are clicking on a purchase button or other legitimate link, when in fact, they are downloading malicious software through an invisible button.

Typosquatting/ URL hijacking

These malicious websites look identical to the legitimate, official pages apart from one or two tiny, subtle changes, making it extremely difficult to tell the difference except for the most observant and discerning visitor. This type of phishing exploits users genuine typo mistakes when entering a website address into the URL bar. The differences could be something as small as misspelling a word in the address, adding an extra letter, or using letters that are next to each other on the keyboard (such as n and m). 

Tabnabbing and reverse tabnabbing

This malicious website appears when a cyber criminal rewrites data on an unattended tab so that any user who returns to this tab will click on malicious links without necessarily realizing it.

Several aspects indicate if an email or website isn’t legitimate and could contain malicious software. Here are a few things to keep your eye out for:

• Check the email sender - if it is from an official source, it will end in that company’s domain. If it is a personal email address ending in generic domains such as Gmail or Yahoo,  this should make you think twice before clicking anything.

• Check the URL - before clicking any further on a link or site, check the URL; is the spelling correct? If you hover over the link with your mouse cursor, you can see the full address. If in doubt, search for the official site to access it this way.

• Spelling/grammar errors

• Sense of urgency - cyber criminals exploit and manipulate a person’s need to react quickly if they are told they need to do something now. Don’t rush, look at the email carefully, and think before you click anything.

• Suspicious attachments/links 

These are just a few things to look out for in an email or website, but the main tip we can provide is to be cautious before you click on any link or attachment, especially if you don’t personally know the sender. Don't rush to click anything, take your time to properly look at the email or website in front of you.