Spear phishing is on the rise in the US and is quickly becoming the biggest cybersecurity threat for businesses. With more sophisticated, human-like emails and a greater reliance on email communication in general, it can be difficult to spot a standard phishing attack, let alone a spear phishing one.
What is spear phishing?
As the name suggests, spear phishing targets a specific individual. This tactic is often more successful than standard phishing emails due to their genuine appearance. Through dangerous, sometimes malware-laden links, criminals steal sensitive data, penetrate organizations, and cause security threats for everyone involved.
In this kind of attack, fraudsters impersonate a known contact of the victim — making it more realistic and dangerous. Through social media sites like LinkedIn, they gain insights into the roles and responsibilities of different people within an organization and use this information to build a credible narrative.
Top 7 signs to watch out for
Falling victim to a spear phishing attack can have disastrous financial — and reputational — consequences for a company. However, spear phishing isn’t undetectable. There are signs you can watch out for to stay protected against these cybersecurity threats:
1. An eye-catching subject
Spear phishing subject lines usually provoke an urgent response. For example, the subject could read “Urgent action required!” in the hope that you’ll act impulsively and engage. If you feel the subject line is reeling you in due to urgent, threatening, or intriguing language, think twice and consider looking for other signs that it may be a scam.
2. Low-quality images
Most companies will provide high-quality logos and images in their email signatures. Cybercriminals, on the other hand, rarely care about such details. Their only aim is to deceive individuals. If you get an unsolicited email containing grainy graphics, it could be a sign of something more sinister. Verify that it’s legitimate before clicking on any links or attachments.
3. An unfamiliar tone
Spear phishing criminals will use a known contact of yours to try to trick you into downloading malware. Take note of the tone and overall appearance of the message, and check that it matches previous emails from the same person. Are there unusual spelling mistakes? Are they overly familiar or overly formal?
Trust your instincts. If the language seems strange, ignore the email or contact the sender through other means before responding.
4. Inconsistencies in links, addresses, and domains
Look for discrepancies in email addresses, links, and domain names to identify a potential spear phishing attempt. It’s worth checking the sender’s email address against previous messages to make sure they match.
If there’s a link embedded in the message, hover over it to reveal the URL. If it leads to a malicious website (with a different domain name), don’t click on it. Report it immediately.
5. Unusual requests
Spear phishing fraudsters sometimes impersonate a manager or colleague, asking victims to complete a task or reminding them to fill in a form. Whatever the request may be, think about whether it’s reasonable, sensible, and aligns with the company’s internal procedures.
For example, if your “security team” sends an email asking you to download a new software program, even though this is normally handled without your involvement, you might be being phished.
6. Questionable timestamps
The timing of a spear phishing attack plays an integral part in its success. Emails from colleagues sent out of working hours are highly suspicious, and emails from friends at questionable times are a red flag. Check the email’s timestamp and compare it with its contents and previous messages from the sender. If you have any suspicions, proceed with caution and look out for any other telltale phishing signs.
7. A mystery company
If you’ve never had dealings with the organization that sent the email, it’s a sure giveaway that the email is a spear phishing attempt. Receiving unsolicited emails out of the blue — from companies you don’t know — is highly uncommon. Tread carefully, and avoid any links or attachments this email may contain.
Why is spear phishing so effective?
Unlike other cybercrimes, spear phishing is not purely technological — there’s a psychological element involved. Criminals prey on victims’ fears and anxieties to provoke an impulsive decision, and the high level of personalization disguises any cause for concern.
At KnowBe4, we understand that knowledge and vigilance are key to prevention, which is why we created KnowBe4 Defend to educate users in real-time, transforming them into the first line of defense.
