- PHISHING ELECTRONICS WITH MALICIOUS URL
- Clickfix attacks also increased 400% year after year
- An approach to security layers is the best way to defend
Phishing and Malicious URL scams continue to be the ruin of the business world, increasing year after year and increasingly dangerous, warned new research.
A new ProofPoint article, based on data from the company’s threat intelligence platform, argues Phishing’s emails with URL, instead of attachments, are increasing in popularity; That clickfix is currently the number one method to deceive the victims to infect; And that most criminals are interested in stealing login credentials.
PHishing’s emails have always been the number one initial attack vector, due to its simplicity, low cost and prevalence OMNI. However, delivering malware through attachments is no longer so simple, with different email safety solutions that become quite good scan and filter malicious content.
Clickfix, QR codes and SMS messages
The cybercriminal community responded by turning to the URL: these days, four times more than the attachments are used. This is because they are easier to disguise, and more likely to evade detection, ProofPoint argues. The criminals would embed them in messages, buttons, even within the benign attached files, such as PDF or Word documents.
In many cases, the URLs lead to sites with a clickfix emerging window. Clickfix is a phishing technique where victims are shown a false error and are given the means to “solve” the problem immediately. These attacks also increased almost four times year after year.
ProofPoint also said that most threat actors are interested in stealing session, since it detected 3.7 billion URLs based on URLs destined to steal these secrets. This is mainly due to the fact that childhood malware such as COGUI or Darcula are low -skill phishing kits that can be easily obtained and deployed.
Other notable methods include threats of QR code (QUISHING) and SMS Phishing (SMISHING) code, with this last increase of 2,534% year -on -year.
“The most harmful cyber threats today are not aimed at machines or systems. They are directed to people. In addition, phishing threats based on URL are no longer limited to the entrance tray, they can be carried out anywhere and, often, are extremely difficult to identify for people,” said Selena Larson, an analyst of senior intelligence of threats in proofpoint.
“From the QR codes in emails and false pages of captcha to scams of threats of threats of threats of first instance, the attackers are assembling reliable platforms and family experiences to exploit human psychology. Defense against these threats requires a detection of multiple layers and a security strategy centered on human.”
How to defend against phishing
The best defense against PHISHING Electronic Postcit with Malicious URL is layer protection.
Companies can start with an email security gateway that blocks suspicious links even before they can reach the entrance tray. Then, with the isolation of the browser, or the writing of links, the systems can “deton” (trigger, basically), url in a safe environment.
Finally, each company must train its employees on how to detect pHishing emails, how to pass the closure of links to verify where they drive, how to verify the senders and avoid clicking on unexpected messages. Finally, it is always recommended to enforce multifactor authentication (MFA), as well as maintain the protection of the updated end point to catch malware if someone clicks.
Finally, companies must implement strict access controls and monitoring so that even if a link slides, the damage remains content.
