Here’s how hackers are using targeted phishing to gain your personal info

As the software security companies tighten the grip on ransomwares, phishing and other dubious methods carried to extract personal information, hackers too find new ways to make their way into the user’s mailboxes. Highlighting this is Kaspersky’s new Q2 2020 report on spam and phishing. For those unaware, phishing is often used to take out personal information that often includes financial credentials such as bank account passwords or payment card details, or login details for social media accounts. This time, the report states that hackers have started targeting phishing with small businesses in focus. 

“Phishers increasingly performed targeted attacks, with most of their focus on small companies. To attract attention, fraudsters forged emails and websites from organizations whose products or services could be purchased by potential victims. In the process of making these fake assets, fraudsters often did not even try to make the site appear authentic. Such targeted phishing attacks can have serious consequences. Once a fraudster has gained access to an employee's mailbox, they can use it to carry out further attacks on the company the employee works for, the rest of its staff, or even its contractors,” states the report.

Also read: Uber ex-security chief charged with covering up data hack

The hackers were able to disguise their communications with unsuspecting users as:

Delivery services – During the pandemic, delivery companies have been active in emailing the updates on products that are being shipped or getting delayed. Similar mails were being used by hackers along with an attachment to find out the address of a warehouse where they could pick up a shipment that did not reach its destination.

Postal services – Fraudsters also used messages with a small image of a postal receipt, hoping that the customer will open it and unknowingly down the Noon spyware, as found by Kaspersky.

Financial services – There were fraud emails offering various benefits and bonuses to customers of credit institutions due to the pandemic. These contained a file with instructions or links to get more details. However, the link could give fraudsters an access to users’ computers, personal data, or authentication data for various services.

Also read: Taiwan accuses Chinese hackers of targeting its citizens’ data

HR services – Lastly, the fraudsters also used HR-related emails, which when opened by office employees will download trojan, which is often used for downloading and installing encryptors. The mails were regarding medical leave procedure, news about their dismissal and more.

What can you do?

Kaspersky has however given some tips on how you can save yourself from such attacks. You can always check the online addresses in unknown or unexpected messages. Not just the ID but users can also see the website that is being opened and redirected towards. In case you are not familiar with the website and not sure about it, do no enter your credentials. “If you think that you may have entered your login and password on a fake page, immediately change your password and call your bank or other payment provider if you think your card details were compromised.”