Spear phishing is a highly personalised form of email attack. Attackers research and target people with carefully designed messages. They often impersonate a trusted colleague, a website or business. The most often impersonated are Apple ID and Microsoft Accounts. The emails typically try to steal your login credentials or financial information. They are also designed to evade traditional email security using spoofing techniques or links to sites which haven’t been used in previous attacks (so internet security programs don’t block them) or redirecting you to a hijacked legitimate website.
There are 2 main types of spear phishing. The first is brand impersonation. These are your “Dear Customer your Apple ID has been compromised, click here to secure your account” or “did you make this random purchase? Arrange a refund here…” except your account hasn’t been compromised and if you do click the link it takes you to a copycat website where you duly put in you account details, confirm your credit card and the site steals your information.
The second is blackmail, usually sextortion. “We have video of you watching pornography and we will send it to everyone in your address book unless you pay us hundreds of $$$. We know it is you because this is your password”. 1 in 10 spear phishing emails are sextortion attacks. Attackers often include the victims email address or password as if to prove they are genuine. (but these have been taken from one of the hundreds of online breaches that have happened). You can safely ignore these threatening messages.
If you do fall for one of these spear phishing attempts, don’t panic! Log in as soon as you can and change the password on the associated account (e.g. apple ID or Hotmail) and notify your bank if you gave your card number. But make sure you go to the genuine website and not the fake one that you just got compromised on.
To help prevent being caught, treat every email asking for you to login with suspicion and use Multi-Factor-Authentication (MFA) and two-step verification to provide an additional layer of security above the username and password.
If you have your own email domain, I offer an affordable email security, which blocks spam and spear-phishing before it reaches your inbox. If you would like more information, please get in touch on 01675 470105 or caroline@putertutor.co.uk.
Safe ‘Putering
