Spear-phishing is a targeted attempt to steal sensitive information such as account credentials or financial information from a specific victim, often for malicious reasons. This is achieved by acquiring personal details on the victim such as their friends, hometown, employer, locations they frequent, and what they have recently bought online. The attackers then disguise themselves as a trustworthy friend or entity to acquire sensitive information, typically through email or other online messaging. This is the most successful form of acquiring confidential information on the internet, accounting for 91% of attacks.

 

What is Spear Phishing?

Spear phishing is a cybercrime that uses emails to carry out targeted attacks against individuals and businesses. Criminals use savvy tactics to collect personal data about their targets and then send emails that are familiar and trustworthy. These emails often have attachments that contain malicious links containing malware, ransomware or spyware. Additionally, the email will blatantly ask the recipient to urgently respond, for example transfer a specific sum of money or to send personal data such as a banking password.

 

How does Spear Phishing Work

Spear phishing happens when an innocent victim responds to a fraudulent email request demanding action. This action can include providing passwords, credit card details, clicking links to confirm shipping information or to transfer money.

These spear phishing emails seem believable because the cybercriminal has collected key personal information about the recipient. This information is used in the email to trick the recipient into believing the email is legitimate.

Often these emails appear to come from the recipient’s manager, colleague, friend, family member, bank, or a popular online store. Using a tone and voice that expresses urgency, the recipient is compelled to take action immediately to prevent large losses, a legal charge or a shutdown of an account.

 

The Impact Of Spear Phishing

Phishing schemes come in a variety of forms. Malicious links, ransomware attacks, clone phishing, and brand impersonation attacks are the most common spear phishing techniques. One of the most famous data breach attacks as a result of spear phishing was Anthem, a healthcare insurer.  The spear phishing attack gained entry to over 78 million healthcare records.

Ubiquiti Networks is another example. This one was with execution of international wire transfers. In this case, spear phishing induced the finance organization to transfer 46 million to scammers internationally through the wire transfers. They were able to recover about 8 million of that 46.

Of course, you don’t always have the exact examples because not everything is public, but billions of dollars of losses in spear phishing attacks against businesses, primarily targeting financial transactions and wire transfers.


How to Spot a Spear Phishing Attack?

 

1. Check Sender Email Address and Name

Impersonation is seen to be the most frequent form of a spear phishing attack. So, one of the most used tactics in spear phishing is to create a website with a domain name that replicates a well-known organization. Letters can be misused to fool unsuspecting users, and websites are all but utterly identical to the true site.

2. Check the Email Format

If you observe the email format not matching with any of the emails you used to receive from that sender in the past, take further measures to confirm the legitimacy of the email. Such email can be a spear phishing attempt to trick you to share the sensitive information.

3. Do not download attachments

Many attachments included in spear phishing emails include embedded malware, or they will consist of forms where you need to enter your most sensitive information. Malware comes typically in the form of an .exe file. Other commonly used files are .zip files, PDF, Word, and Excel documents.

 4. Verify Shared Links

The attacker tricks you to click on a link shared via email. Even if you are sure about the sender email address and the name, make sure the link embedded in the hypertext does not lead to a fraudulent website or malicious code. The simple trick to identify the legitimacy of the link is by hovering over the link. It gives you a complete address of the link that you shall be redirected to after clicking. If you see the web address or the link path is suspicious, never click the links. Your one click can hijack your web browser, install malware in your system, and even get full control of your system and all the stored information.

How to protect yourself from Spear Phishing Attack

1. Keep your system up-to-date

Although a simple solution, regularly updating your operating system can effectively fight against spear phishing. Software updates usually contain patches to plug any security vulnerabilities. Without these patches, your device is a magnet for malware.

2. Encrypt Sensitive Information

File encryption is a good way to protect sensitive company data from prying eyes. With the right tool or solution, the files you send to your systems, cloud environments, trading partners, and remote locations will be secure, making it difficult for outside parties to decrypt your data even if they get their hands on it.

3. Implement multi-factor authentication

Multi-factor authentication is a simple way to ensure anyone who accesses your private data is legitimate. How does it work? It requires at least two pieces of identification, like a login and randomly generated token, which makes it infinitely harder for hackers to compromise your systems—even if they have half the information needed to get in. Implement MFA wherever you can—at work and in your personal life. At the very least, it’ll give you an extra layer of protection against spear phishing and other potential data breaches.

4. Secure your personal information

Cybercriminals use the information that you share online to build trust and lure you in. Keep your social media accounts private to know exactly who can see what and be smart about what you post. Locking down your passwords is also vital to limit the consequences of these attacks. A password manager creates strong, varied passwords. So, even if a fraudster gets their hands on your login credentials, it won’t compromise any other accounts.

5. Make cyber security a company focus

Learning about the risks and how to spot these scams is an essential prevention tool. Companies must prioritise cyber security training for new recruits to ensure everyone understands what to look out for and how to react if a spear phishing attack happens. It’s also critical that employees are empowered to come forward if they are targeted by an attack. Implementing a solid reporting protocol will enable employees to safely report incidents without falling victim to the scam — preventing any future attacks. Cybercriminals rely on the ability to manipulate people.

 

Using the guide above, businesses will be able to quickly spot some of the types of phishing attacks. However, it is worth noting that phishing attacks are constantly evolving. Therefore, the only way to stay one step ahead is to enhance your knowledge and join a security awareness training programme that will help you stay on top of evolved phishing attacks.