PHISHING ATTACKS IN THE INTERNET WORLD

               PHISHING ATTACKS

What is phishing?

Often carried out over email -- although the scam has now spread beyond suspicious emails to phone calls (so-called "vishing"), social media, SMS messaging services (aka "smishing"), and apps -- a basic phishing attack attempts to trick the target into doing what the scammer wants. 

Exactly what the scammer wants can vary wildly between attacks. It might be handing over passwords to make it easier to hack a company or person, or sending payments to fraudsters instead of the correct account. This information is often stolen by making requests that look entirely legitimate -- like an email from your boss, so you don't think twice about doing what is asked.

Phishing is also a popular method for cyber attackers to deliver malware by encouraging victims to download a weaponized document or visit a malicious link that will secretly install the malicious payload in attacks that could be distributing trojan malware, ransomware or all manner of damaging and disruptive attacks. 

Why is phishing called phishing?

The overall term for these scams -- phishing -- is a modified version of 'fishing' except in this instance the one doing this fishing is a scammer, and they're trying to catch you and reel you in with their sneaky email lure. In most cases, they will put out many of these lures. Most people will ignore these scam emails, but someone eventually bites.

Who is a target of phishing scams?

These scams can target anyone, anytime. The aim and the precise mechanics of phishing scams vary: for example, victims might be tricked into clicking a link through to a fake web page with the aim of persuading the user to enter personal information. In this case the lure might be that you've won a prize, or a chance to grab a must-have special offer, or (oh the irony) a claim that your account has been hacked and you should login to take action. 

More complex phishing schemes can involve a long game, with hackers using fake social media profiles, emails and more to build up a rapport with the victim over months or even years, especially in cases where specific individuals are targeted for data that they would only ever hand over to people they trust. 

That data can range from your personal or corporate email address and password to financial data such as credit card details, online banking accounts and cryptocurrency wallets, or even personal data including your date of birth, address and a social security number. 

In the hands of fraudsters, all of that information can be used to carry out scams such as identity theft or using stolen data to buy things or even selling your private information to other cyber criminals on the dark web, who can use it how they please. For example, phished usernames and passwords are regularly the starting point for ransomware attacks. 

How does a phishing attack work?

A basic phishing attack attempts to trick a user into giving away personal details or other confidential information, and email is the most common method of performing these attacks. 

The sheer number of emails sent every single day means that it's an obvious attack vector for cyber criminals. Over 300 billion emails are sent every day -- and it's believed that at least three billion of these are malicious phishing emails.