Classic phishing is the most common type of phishing. Discover what it is and how to protect your company from this type of attack.
Phishing’s origins have been traced back to 1995. That’s when a group of hackers devised several schemes to steal money and sensitive information from America Online (AOL) users. Many of the tactics used back then are still in use today. As a result, this type of phishing is referred to as classic phishing.
In classic phishing, cybercriminals send a massive number of cookie-cutter emails to people all over the world. In these emails, hackers masquerade as a reputable person or a legitimate organization. Using a convincing pretense, they try to trick the email recipients into performing an action. Typically, they want the recipients to click a malicious link or open a weaponized email attachment.
What happens next varies widely. The malicious link might lead to a spoofed (i.e., fake) website designed to capture victims’ credentials or it might lead to a site that installs malware on their devices. Opening the weaponized attachment might also lead to victims’ devices being infected with malware. The malware might be a web trojan that collects credentials from victims’ devices or a keylogger that captures input from their keyboards.
The credentials, account information, and other sensitive data gathered from a classic phishing attack is often used to steal the victims’ money or data. Sometimes, though, it is sold to other cybercriminals on the dark web.
10 Signs an Email Might Be a Classic Phishing Scam
Out of the three types of phishing, classic phishing scams are the easiest to spot. For more than 25 years, hackers have been sending out massive mailings of them, giving security researchers plenty of specimens to dissect and analyze. Researchers have found that classic phishing emails often include one or more red flags. An email might be a classic phishing scam if it includes:
How to Defend Your Business Against Classic Phishing Attacks
To protect your business from classic phishing attacks, you can use the stop, educate, and mitigate strategy:
Stop as many classic phishing emails as you can from reaching employees’ inboxes. To do so, you need to keep your company’s email filtering and security solutions up-to-date. You might also want to explore getting an email security solution that uses advanced technologies to catch malicious emails.
Educate employees about classic phishing emails so they can spot any that reach their inboxes. It is important to educate employees about classic phishing scams and how to spot them (e.g., generic greeting, misleading links). As part of this training, be sure to inform them about the risks associated with clicking an email link or opening an email attachment, especially if the email is from an unknown sender. Also show them how to check for misleading links in emails by hovering the mouse cursor over them (but not clicking them).
Mitigate the effects of a successful classic phishing attack. Hackers are continually coming up with new classic phishing schemes, so your company might fall victim to an attack despite everyone’s best efforts to prevent it. Taking a few preemptive measures might help mitigate the effects of a successful classic phishing attack. For example, since obtaining login credentials is the goal of many classic phishing scams, you should make sure each business account has a unique, strong password. That way, if a phishing scam provides hackers with the password for one account, they won’t be able to access any other accounts with it. Equally important, you need to perform backups regularly and make sure they can be restored. This will enable you to get your data back if an employee inadvertently initiates a ransomware attack by clicking a link or opening an attachment in a classic phishing email.
The individual steps for implementing the stop, educate, and mitigate strategy will vary depending on your business’s needs. We can help you develop and implement a comprehensive plan to defend against classic phishing emails.