Category
Email SecurityPhishing emails have gotten much harder to spot. The obvious typos and Nigerian prince scams still exist, but the attacks targeting businesses today are far more polished. Here are the techniques attackers use and how to catch them.
Attackers forge the sender’s email address to make it look like it’s coming from someone you trust. They use subtle substitutions that are easy to miss at a glance:
rn instead of m (looks identical in many fonts)1 instead of l.co instead of .comHow to catch it: Hover over the sender’s name to see the actual email address. Compare it character by character against known addresses.
URLs that use characters from different alphabets (Cyrillic, Greek) that look identical to Latin characters. аpple.com using a Cyrillic “a” looks exactly like apple.com but leads to a completely different server.
How to catch it: Don’t click links in emails. Navigate to websites directly by typing the URL yourself or using a bookmark.
Attackers gain access to a real email account and send phishing messages from it. Since the sender is genuine, standard email checks won’t flag it.
How to catch it: Watch for messages that seem out of character for the sender, unexpected requests, or communications at unusual times. Verify unusual requests through a separate channel.
Using data from social media, LinkedIn, data breaches, or company websites, attackers craft messages tailored to you specifically. They reference real projects, colleagues, or events to build credibility.
How to catch it: Be suspicious of unexpected messages even if they reference real details about your work. Attackers research their targets.
Phishing sites now routinely use HTTPS with valid certificates. The padlock icon means the connection is encrypted – it says nothing about whether the site is legitimate.
How to catch it: Never rely on the padlock icon alone. Check the full URL carefully. Better yet, navigate to websites directly rather than clicking email links.
Messages designed to trigger panic: “Your account has been compromised,” “Payment is overdue,” “Act within 24 hours or your data will be deleted.” The goal is to make you act before you think.
How to catch it: Treat urgency as a red flag, not a reason to rush. Legitimate organizations give you reasonable time to respond and provide multiple ways to verify the message.
PDFs, Word documents, Excel spreadsheets, and ZIP files that contain macros, scripts, or embedded malware. They often look like invoices, contracts, or reports.
How to catch it: Don’t open unexpected attachments. Verify with the sender through a separate channel. Keep macros disabled by default in Office applications.
Attackers copy legitimate emails from companies like Microsoft, Google, DHL, or your bank pixel-for-pixel, then swap the links for malicious ones. The visual match is often perfect.
How to catch it: Inspect links before clicking (hover to see the destination). Be especially careful with password reset emails, delivery notifications, and account alerts you weren’t expecting.
Phishing emails that automatically insert your name, company, job title, or other details pulled from public sources or stolen databases. This makes mass phishing look like a personal message.
How to catch it: Personalization alone doesn’t make an email legitimate. Focus on whether the request is expected and whether the sender address is verified.
The first email is completely harmless – a meeting request, a document share, a friendly introduction. It builds trust. The second or third message in the thread contains the actual attack: a malicious link or request for credentials.
How to catch it: Stay alert even in ongoing email threads. Attackers sometimes hijack real conversations after compromising one participant’s account.
When evaluating any email, ask:
When in doubt, don’t click. Verify independently. Report it to your IT team. You can also forward suspicious emails to ForwardToSafety.com for verification before taking any action.
Join thousands of security professionals who receive Craig Peterson's Insider Show Notes and cybersecurity updates.
Tagged with: