Most of us can think of a time when we received a phishing email. In fact, most phishing emails are easy to identify, and automatically go to spam.
However, in this ongoing pandemic, hackers are adopting advanced tactics that cleverly conceal their malicious intentions, and fly under the radar by leveraging the victim’s fear, anxiety, or plain negligence. Claiming to have information about the coronavirus, these phishing emails inject malware, steal credentials, and can even extort money out of users.
In this blog, we’ll provide you with five tips you can use to protect yourself and your organization against these dangerous phishing attacks.
1. Check the sender’s email address
If the sender’s email address appears distrustful, it probably is. A misspelled domain name or a business email sent from a public domain email address is a clear giveaway that it is not from a trusted source. If you’re doubtful, try to visit the organization’s official website and contact them through chat or a phone call to determine if the message is legitimate. If the organization’s only method of contact is an email address, consider it a red flag.
If you do not have a relationship with the sender, or the email address is not consistent with the identity of the sender, more often than not it is a phishing email.
2. Check the quality of the email content
If you find typos, grammatical mistakes, or strange turns of phrase in an email from a reputable organization, it’s a clear sign that you’re being phished. Emails from legitimate organizations are constructed by professional writers and exhaustively reviewed for spelling, grammar, and legality errors.
3. Check for malicious links in the email
Attackers can mix authentic links, such as the genuine privacy policy of the company they are mimicking, with malicious links. These malicious links may lead to fake phishing websites that look exactly like the company’s genuine website.
Logos and the appearance of websites are very easy to copy, so you should always double check if you are on a genuine website by checking the URL. The simplest way to do this is to hover your mouse over the link or button without clicking it, and your browser will reveal the link. Check if the link has https:// at the beginning of the address. The https:// indicates that the website is secure and uses encryption to transfer data, protecting it from hackers.
4. Check for malicious attachments
Phishing emails can include malicious downloadable files, often sent as compressed ZIP files or document files, which can infect your computer with malware. Avoid opening attachments from any email address that you don’t know personally.
Social engineering techniques enable a hacker to mimic your employer or colleague to send malware in the form of document attachments. If you receive a document that asks to run macros, consider it a red flag. To be safe, try opening the document in an online document viewer to determine its authenticity.
5. Do not react immediately
Avoid emails that insist you act immediately. Phishing emails often try to create a sense of urgency or demand immediate action. The motive is to get you to click on a link and provide personal information so they can use it to scam you.
If you receive an email offering immunity boosters or COVID-19 health insurance at an 80 percent discount, walk away. Chances are you will never be contacted after making the payment.
To further keep your organization completely protected from phishing attacks, use our comprehensive security information and event management (SIEM) solution, Log360. Its threat intelligence module can help you secure your network from various types of threats, including malware, phishing and spam, advanced persistent threats, communications from callback servers, and botnet attacks.
The solution contains a built-in threat intelligence processor that automatically retrieves the latest threat feeds from trusted open sources like AlienVault OTX and Hail a TAXII, and scans your network continuously for signs of malicious activities. Log360 also enables you to add custom STIX/TAXII-based threat feeds, and seamlessly integrate them within your threat intelligence program.
Check out Log360 today.
