A Closer Look at Common Types of Phishing Attacks

Updated March 22, 2024

Phishing is among the biggest cyber threats facing businesses today. An estimated 91% of incidents that end in a data breach start with a phishing email. Phishing is a favorite tool of hackers, so it’s important to understand it and recognize it. We’ll take a closer look at three common types of phishing attacks to learn what to look for and how you and your employees can avoid being a victim.

What is phishing?

Phishing is a kind of cyberattack used to steal users’ sensitive data like personal information, login credentials, and credit card numbers. A phishing attack is often carried out with fake emails and cloning of legitimate websites to trick users into revealing sensitive information.

3 types of phishing attacks and how to avoid them

Spear Phishing

Spear phishing is one of the most common types of phishing attack and can be aimed at anyone at any level in an organization. Spear phishers gather information about you, so they legitimately look and sound like the person or entity you trust. When successful, unsuspecting victims often willingly hand over their information, which can include data that allows these scam artists to log into your accounts, gain access to your finances, or hack your data. Victims will also click on links and attachments, unknowingly downloading malicious codes or malware attachments.

Tips to avoid Spear Phishing

• Be cautious of urgent email subject lines.
• Don’t click on suspicious attachments and links.
• Watch for grammatical errors in the content.
• Verify the sender’s email address.

Things to look for: urgency in the subject and body; whether the sender’s email address is in your outlook address book; don’t click on links you aren’t sure about.

Whaling

Whaling is a more targeted type of spear phishing that takes aim at senior executives and CEOs. This type of phishing message is crafted to imitate a company executive or to fool a company executive into thinking the message is from a trusted source. Impersonating someone the victim knows differentiates it from spear phishing. A company executive is the ultimate prize for cybercriminals as the boss can access information and resources that no other employee can reach. Attackers use whaling to gain access to money, attack a supply chain, steal intellectual property, and distribute malware.

Tips to avoid Whaling 

• Ask yourself if you were expecting the communication.
• Review the communication for unusual urgency or expression.
• Check if the email address is consistent with the naming convention of your company.
• Ensure senior executives are educated on what to look for.

Things to look for: an unusual request; urgency in the body; don’t click on attachments you aren’t sure about.

Angler Phishing

Angler phishing is a newer type of attack involving social media. Often, attackers entice the target to interact with a fake page so they can capture the victim’s personal information. Cybercriminals are adept at imitating messages from any social network to lure unsuspecting victims. They use email, direct messages, posts, and comments to conduct the phishing. In one of the most common scenarios, the bad actor is pretending to be a customer service representative. The attacker finds people who are complaining online about a business and then responds to their problem before the legitimate company does by using a spoofed social media account. The spoofed account will often have an official looking logo and content. If personal information is provided to the attacker, it can then be used for identity theft. And if a victim clicks on a link, they can be taken to a fraudulent website where their login credentials are stolen.

Tips to Avoid Angler Phishing

• Consider whether you have received a message that looks like this before.
• Read the account name carefully to make sure everything is spelled correctly.
• Look at the number of followers - a customer service account shouldn’t have zero.
• If someone reaches out to you on social media, never click on a link.
• When in doubt, reach out directly instead.

Things to look for: whether you have received an email like this before directly from Facebook; whether you have a direct message from someone in Facebook Messenger; the vagueness of “someone”; don’t click on a link to a login screen where someone can capture your credentials.

Educating your employees on the various types of phishing attacks

Even with the best tools, malicious contacts and emails will still get through. When that happens, the only thing preventing your organization from a breach is your employees’ ability to detect the threat and respond appropriately. Educating your employees on the various types of cyber phishing threats along with general cyber security awareness is essential to protecting your company’s network and data. Your customers also want to know they are working with a company that prioritizes cybersecurity and will protect their data.

Locknet Managed IT is a managed security service provider (MSSP), and our managed IT services include a comprehensive security assessment of your organization. After gathering and analyzing the data of your security assessment, we will develop a playbook with conclusive strategies and recommendations to mitigate risks and achieve your security objectives, along with a roadmap containing budget considerations. For some organizations, this includes security education and awareness training for your employees to stay up to date on new types of cyber phishing attacks. When you’re ready to bring cyber security awareness to the forefront of your employee training program, we’re here to help.