Understanding Link: How They Work and How to Protect Yourself

Phishing attacks are what we call social engineering attacks. In social engineering, the attacker basically tries to trick the victim into doing things they shouldn’t, and how do they do that? Essentially, they’re taking advantage of and exploiting our tendency as humans to trust each other.
 
If we get the right signals, we start to believe something. And we base that trust on that evidence. The problem is that sometimes what we believe isn’t true, and these phishing attacks usually revolve around one or two different motivations: greed and deception. In other words, you can think of it as profit-loss or greed-fear, but the underlying theme of these phishing attacks is usually the same.

In most cases, they want your credentials. They want the information you use to log in. They want to steal your password so they can steal your identity, empty your bank account, and do anything they want in your name.

In some cases, however, they’re actually trying to inject malware into your system, but guess what? Most of this malware is information stealers designed to steal your credentials. So, this is a big part of what we’re seeing: phishing. We’ll look at the different types of phishing attacks, as well as preventative measures you can take to protect yourself.
 
Okay, let’s take a look at some different types of phishing attacks, and we’ll break them down by distribution, context, and type.

Types of Phishing Attacks

1. Email Phishing
 So first, we’ll take a look at the most common delivery format. Everyone has probably received one of these: an email. You receive an email, and it offers you some instructions and some important tasks.
 
Often, the email contains a link they want you to click, and when you do, you receive either malware or stolen credentials. However, if you’re the attacker, we can take another approach; this could be via email, or it could be through another delivery method.

2. Smishing
This could be through an SMS message. And we call that smishing. It could also be through a voice message or a call where someone tells us what to do or leaves a message asking us to call back or something like that. We call that vishing.



3. QR Code Phishing


QR codes, you know, those things, those square things you see everywhere that have little dots on them, and you scan them with your phone, and it takes you to a website. So, which website is it taking you to, a legitimate website or an attacker’s website? What do we call it? Just think about it.

Let’s take a look at the context.

There are many other types. These are just some of the common ones we know about these days. Now, let’s take a look at the context.
 
Fake bank messages: You receive an urgent email saying you need to “verify your information” or your account will be locked. Real banks don’t ask for your login credentials this way – phishers use fear to make you act quickly.
Delivery or courier scams: “We have a package for you that couldn’t be delivered. Click here to confirm your address.” This preys on your fear of missing out – and your eagerness to receive something.

Defending Against Phishing Attacks

There are some actions you can take. Let’s take a look at those defenses.
 
Training and Awareness
 
Make sure that you, and if you’re responsible for training the folks in your organization, make sure they know about this and about this.
 
It’s much better if you see, even if you think it is your bank and there’s a link, then go to the bank’s website directly from a bookmark that you’ve saved, for instance. Go type it in on the URL line in the browser. That’s a lot better than clicking on a link because a link can look like one thing and when you click on it, it actually redirects you to some other place.
 
Use Multi-Factor Authentication (MFA)
 
Another good technology to use here is multi-factor authentication. If somebody’s trying to steal your credentials, that is your password, and that’s all you have to do in order to log in is type in a password, then they’ve got your account. If we have multi-factor authentication, then a password alone will not get someone into your account.
 
They also might have to have something that you possess, like maybe your phone that’s been pre-registered or your face. It turns out that if somebody takes your face, you’re probably going to realize that. That makes it a lot more difficult for an attacker if they have to compromise multiple factors of authentication.

Embrace Passkeys
 
Another thing I’m a big believer in is this technology called PassKeys that comes from an organization called FIDO, the Fast Identity Online organization. It’s an international standard and it’s better than passwords. The passkey will be stronger than the user-chosen password, because people are notoriously bad at choosing passwords.
 
Use Secure DNS
 
Another thing you can do, and many people overlook, is to use secure DNS. DNS is essential, and this is an example of Quad9. DNS is what you use when typing URLs, like if you want to go to a specific place, like IBM.

 
If you stay informed, train yourself and your team, use strong authentication, enable secure DNS, and apply best practices like DMARC and least privilege, you’ll significantly tip the balance in your favor.
Phishing may exploit human trust, but with awareness and the right defenses, you can protect yourself and your organization from becoming the next victim.