The details of phishing scams change from year to year, depending on the pretexts that social engineers can use to convince you to click on a link or open an attachment. Here, we will discuss phishing email examples from some of the top phishing schemes of 2018.
1. Account Verification
2. Cloud-Based File Sharing
Cloud-based file-sharing services like Google Docs, Dropbox and Office365 make business more efficient by providing a fast and easy way to share files and folders across teams. However, the frequency of use and the normality of receiving unexpected documents has made them a prime attack vector for phishers. A common phishing attack consists of a link to what appears to be a shared file on Google Docs, Dropbox or some other file-sharing site. In reality, the link will point to a page pretending to be that file-sharing site and requesting a login. This can be used to steal a victim’s credentials or infect the victim’s computer with a malicious file.
3. Cryptocurrency ICOs
Blockchain and cryptocurrency have become very popular over the last couple of years. In cryptocurrency, an Initial Coin Offering (ICO) sale is a crowdfunding event where the creators of a new cryptocurrency ask the public to send them cryptocurrency to help fund development. The developers provide their address on a well-known cryptocurrency (like Bitcoin or Ethereum) for the money to be sent to. Due to how these blockchains work, it’s impossible to prove that an address actually belongs to an individual. Phishers have taken advantage of this fact by sending out fake ICO sale announcements for popular cryptocurrencies, with the announcement pointing to an address controlled by the attacker. Recipients who want to participate in the sale send cryptocurrency to that address, providing the phisher with a means of profiting from the attack.
4. Docusign
Docusign is a service designed to allow people to digitally sign documents, making it easier to sign leases, contracts and similar paperwork. Since Docusign notifications of signature requests come from a Docusign email address, people don’t expect them to come from an email address that they recognize and trust. Phishers take advantage of this by sending emails that come from a domain that looks similar to the Docusign domain or sounds plausible. If you click on the link, it’ll ask you to sign into your email account to see the document, giving the attackers control of your inbox.
5. Fake Invoices
6. General Data Privacy Regulation (GDPR)
The General Data Privacy Regulation (GDPR) is a European Union (EU) privacy law that went into effect May 25th, 2018. This regulation increased the requirements and penalties for the protection of EU citizen data, and many organizations were unprepared for the new regulation. As a result, phishers used the pretext of providing information or services related to preparing for the regulation as a lure for phishing emails in early 2018.
7. Package Delivery
Everyone loves getting presents, but if you get a delivery notification for a package that you don’t remember ordering, it’s probably a fake. This is one of the older phishing scams out there: An attacker will pretend to be FedEx, DHL or another mailing service and provide you a delivery notification with a link or attachment containing the details of your order. When you go to look up what’s arriving in your mailbox, you’ll be infected with malware or tricked into providing the attacker with your credentials.
8. Political Campaigns
In 2016, phishing emails about the United States Presidential election were common. In 2018, it was Russia’s turn. Russia’s Presidential election was held on March 18th, 2018 and in the run-up, emails asking for participation in public opinion polls were common. In some cases, phishers would promise a reward for participating, incentivizing people to provide their credit card or bank information. As a result, the attackers were able to transfer money out of the target’s accounts.
9. Tax Scam
Everyone hates tax season and phishers make it worse by taking advantage of it. In the weeks and months leading up to tax season, it’s not unusual to see a sudden increase in the number of phishing emails claiming to originate from the U.S. IRS, the U.K. HMRC and other government tax authorities. These emails typically claim that an individual is delinquent on their taxes and provides an alleged means to fix the issue before additional fines or legal action are pursued. But if you follow the instructions in the email, your money goes to the phishers rather than the government.
Conclusion: Protecting Yourself From Phishing Attacks
Phishing is one of the simplest and oldest types of cyberattacks. It’s still around because people continue to fall for it. Protecting yourself from phishing emails is simple. First, check that the email is from a reputable address and not just a lookalike or something that sounds legitimate. Second, never click on hyperlinks in an email. Always go to the site directly in your browser and find the page using internal links. If you can’t, it’s probably a scam. Finally, don’t trust attachments. Both Office documents and PDFs can contain malware. If you get a document that you didn’t expect, pick up the phone and make sure it’s legit before opening it. Following these three simple steps can help save you major headaches from phishing emails.
Sources
Internet Security Threat Report, Symantec Spam and Phishing in Q1 2018, Kaspersky Lab 5 of the Most Notable Phishing Attacks of 2018 … So Far, Barkly
