Single blog | Sky Express

The hacker hook was cast!

Name, surname, e-mail or contact phone number are data that we exchange every day, fwhile working and privately. With the development of new technologies, it is becoming easier to contact more people. The COVID-19 pandemic has significantly changed the way we work, more and more employees are working from home and that brings new security challenges. An increase in cyber attacks is evident due to inadequate protection of the information system and insufficient information of employees about potential dangers, which consequently affects the overall business risk factor. Compromise of data, financial losses, damage to reputation and trust in companies are just some of the consequences. Phishing email is a type of online scam where an attacker uses email to try to "catch" or steal credentials (username and password) or to infect the recipient's computer.

Cybercriminals present themselves as well-known companies and instruct the recipient to download and open the attached files (PDF, Excel spreadsheet, Word document, etc.) or click on the link in the message to get the necessary information. They use websites that they have made themselves, that look identical to the pages of well-known companies or pages that are regularly visited by the recipient.

There is also a "spear phishing" method of attack more sophisticated than ordinary phishing. While phishing targets a wider population, spear phishing targets a clearly defined person in the company. It is usually aimed at CEO, CBO, CFO positions.

Vishing and smishing are types of phishing attacks, which attack the victim through voice calls and texting. Both types usually require an immediate response from the victims. The term vishing originated from a combination of the words voice and phishing, where the phone is used as a means of deception instead of email or a website. Attackers use Voice Over Internet Protocol (VoIP) technology, which allows them to make hundreds of calls at the same time and can easily disguise phone numbers so that the call appears to come from a known source, such as bank.

Smishing (SMS phishing) is an attack via SMS on mobile phones. Usually, a smishing message arrives with the information that the bank account is blocked and that it is necessary to open an attachment or a link to unlock it, after which malicious software is installed on the recipient's system. Often the message contains a tempting offer or threat for the victim to click on the link or call the number within a given time and share sensitive information.

How to be protected?

The best way to be protected from vishing and smishing is to make users aware of the possibility of online and telephone fraud.

You should not trust an unknown caller, or click on links sent by an unknown person. It is necessary to look for numbers and e-mail addresses before the user gets in touch. You should not share any sensitive information with the caller, such as bank account details, credit card details, etc., instead users should contact their bank to make sure the source is legitimate.

It is recommended that you do not answer unknown phone numbers, as caller IDs can be easily falsified. If you answer and suspect that this is a phone call from an unverified caller, end the call and block the number. If you get an automatic message asking you to press keys or answer questions, don't do it. Attackers often use these tricks to identify potential targets for multiple robo calls. They can also record the voice of a specific user and later use it when navigating voice-automated phone menus related to user accounts.

Pay attention and look carefully at each link and each file attached to the email before you click.