EXECUTIVE SUMMARY:

In the complex and vast landscape of cyber security, a subtle danger lurks – trap phishing. As organizations and individuals have become increasingly interconnected, the potential level of harm posed by this insidious tactic has risen in parallel.

Trap phishing encompasses a range of deceptive strategies that are intended to manipulate people into divulging credentials, sharing sensitive data, downloading malicious content and more.

This article sheds light on trap phishing’s various manifestations and trap phishing prevention mechanisms. Leverage the insights and best practices outlined below to fortify your defenses and to safeguard your environment.

What is Trap Phishing?

Trap phishing aims to convince people to click on malicious email elements. Trap phishing differs from traditional phishing in that it exploits the trust between the email recipient and someone (or a brand) that the recipient knows.

A trap phishing scammer may send an individual false information or may hijack a legitimate-looking webpage or social media account; effectively setting up a ‘trap’ for a potential victim.

Types of Trap Phishing

• Email-based trap phishing. In this form of trap phishing, cyber attackers create emails that look nearly identical to legitimate emails from authentic companies. Within a trap phishing email, there’s inevitably a line that urges (potential) victims to click on a link or to download an attachment. The email signature will likely impersonate a company’s CEO, CTO or anyone else who the victim might know within a given organization.
• Vishing trap phishing. In these attacks, cyber criminals call victims while impersonating specific representatives of real companies (people who victims will be familiar with). Vishers attempt to sound legitimate. They often leverage information that they’ve collected via social media to improve their plausible credibility.
• Social media phishing. In this form of trap phishing, cyber attackers develop fake social media accounts that “spoof” the accounts of genuine individuals or enterprises. Attackers then publish links to fake websites or to malicious, hacker-controlled downloads.
• Content injection. In these cases of trap phishing, cyber criminals inject malicious code into a legitimate website. This is, of course, unbeknownst to the website’s owners and users. The malicious code enables cyber attackers to redirect visitors to a duplicate website where they will attempt to collect personal information. Such information is then listed and sold on the dark web.
• SMS/Text phishing. Cyber attackers may send fake text messages to cajole a victim into clicking on a malicious link. We’ve all seen these – some look like they’re from banks, others appear to be from delivery companies…etc. The links included in these text messages are controlled by cyber attackers and enable them to obtain victim’s credit card details, personal information and/or other sensitive data. In theory, an attacker could then change an individual or organization’s account login details. Subsequently, an attacker could transfer money, contact a bank, or sign the victim/s up for other services – all while sounding legitimate.

Preventing Trap Phishing

1. Employee training and awareness. Broadly raise awareness around both old and new social engineering techniques. In so doing, provide employees with comprehensive training around how cyber attackers deploy trap phishing attacks. Use real-world examples. Also, consider conducting regular phishing simulation exercises in order to reinforce learning and to help employees spot potential phishing traps.

2. Multi-factor authentication. Encourage employees to use strong multi-factor authentication methods for all critical systems and accounts. Consider implementing contextual MFA. This examines user behavior and request context in order to determine whether or not additional identity-based access verification is needed. Further, remind employees not to share multi-factor authentication codes over the phone – no matter how legitimate the caller seems.

3. Up-to-date devices. Among employees, reinforce the importance of keeping devices and software up-to-date. This minimizes vulnerabilities and can help in the event that an employee clicks on a link or an attachment and then realizes that it’s a phishing attack.

4. Communication channel security. Elevate your organization’s communication channel security. Ensure that emails are encrypted and that employees use secure messaging platforms for discussions about sensitive information. Explore the implementation of controls that prevent attackers from intercepting communications between employees and third-party groups (suppliers, vendors…etc.).

5. Access controls and monitoring. Leverage strong access controls that restrict access to core systems and sensitive information. Use the principle of least privilege. Beyond that, monitor for atypical behavior and access patterns that could indicate a potential attack. Review alerts for changes in account details, financial transactions or requests for access to sensitive data.

Increase your organization’s resilience to trap phishing attempts by implementing the phishing prevention strategies outlined above.

For more insights into phishing tactics, please see CyberTalk.org’s past coverage. Lastly, to receive more timely cyber security news, insights and cutting-edge analyses, please sign up for the cybertalk.org newsletter.