Phishing remains one of the most popular avenues of attack by cybercriminals. Yes, zero-day exploits sometimes help them to strike gold. But the bread-and-butter front-line troops of cybercriminal gangs are phish-ers of men and women.
It is rumored that in some regions these scammers work in office buildings , much like regular employees in the work-a-day world. They clock in at 9 am, enjoy the office banter, gather round the water cooler, maybe even get some employee benefits, and clock out at 5 PM. The only difference is their job descriptions revolve around phishing and hacking. Some devise campaigns while others are involved in areas such as researching phishing success, finding the best potential targets, composing new subject lines for emails, inserting malware into attachments and URLs, setting up fake websites, cold calling people, sending text scams, and trawling through social media to glean valuable data on high-value targets. This could be characterized as the ugly stepchild of modern marketing. They work hard to trick you. Some are really good at it.
Hot Phishing Subject Lines to Watch Out For
The latest report on phishing from security awareness training vendor KnowBe4 lays out the top email subjects clicked by users in the simulated phishing tests they conduct, the top attack vectors, and popular phishing email tactics.
Bottom line: Phishing via email continues to be one of the most common and effective methods to maliciously impact users and networks. The report lays out the ways in which cybercriminals constantly refine their strategies and how this helps them to keep outsmarting end users. They regularly review the click rates of their email subject lines. If the numbers dip sharply, they change the campaign or the topic. They are always looking at the headlines for something that will grab user attention to lead to an inadvertent click.
Most recently, phishers have focused on business-related email subjects as being the most fruitful. That’s why you are seeing so many fake messages about HR, IT, management issues, as well as subject lines about web services such as Google and Amazon. A big surprise in this year’s KnowBe4 report is that nearly 50% of email subjects were about HR matters. The rest were primarily on career development, IT issues, and notifications about work projects.
Users have grown accustomed to receiving regular emails from HR to do this or that, comply to X, or complete Y by end of week. Scammers know this. They send genuine-looking emails about fake HR subjects (and sometimes they even hack into corporate email systems and send these phishing emails from an actual HR user account). Users tend to open these emails and a good number click on the attachments or links. This either directly infects their systems, or fools them into entering login and other personal details.
What Users Need to Do to Minimize Phishing Impact
Here are some of the following steps to avoid falling prey to phishing scams:
- Institute regular security awareness training to keep users up to speed on the latest tactics used by scammers
- Simulate phishing attacks to measure user tendency to click on malicious links and attachments.
- Conduct regular scans of all endpoints on the network to locate vulnerabilities, weak points, unpatched systems, and misconfigurations.
- Deploy an automated patch management system to ensure all endpoints are properly patched.
Syxsense Enterprise delivers real-time vulnerability monitoring, automated patch management, instant remediation for all endpoints, IT management, Mobile Device Management (MDM), and zero trust capabilities across your entire environment. Breaches can now be detected and remediated within one endpoint solution. It can scan for all vulnerabilities on any device, block communication from an infected device to the internet, isolate endpoints, and kill malicious processes before they spread. It automatically prioritizes and deploys OS and third-party patches to all major operating systems, as well as Windows feature updates. IT and security teams can use Syxsense Enterprise to collaborate on the detection and closing of attack vectors. It offers management, control, and security for any and all desktops, laptops, servers, virtual machines, and mobile devices.
For more information, visit: www.Syxsense.com
