Phishing Gets Sophisticated
August 18, 2021
We've seen a significant increase in phishing attempts that are getting more sophisticated and legitimate looking.
Phishing is when hackers try to gain your sensitive information by sending you an email that looks like it's from a legitimate company but is really a means for them to trick you into providing the info they seek.
Most phishing emails are unsophisticated. They are often filled with typos, improper English (because hackers are usually foreign agents), unprofessional designs, incorrect logos or company names, etc. In addition, the "from" email address almost never belongs to the company the email is supposedly from. A phishing attempt pretending to be from Apple, for example, should have a from address that is something like support@apple.com. Instead, you'll see something like fiend722@hotmail.com, which is clearly not from Apple.
However, lately we've been seeing much more sophisticated phishing attempts. Take the following screenshot of an email we recently received as an example:
There's a lot of attention to detail that makes this phishing attempt appear to be a legitimate email, including the correct company name and logo, correct typography and design elements that follow IONOS's actual branding, and proper English with no typos. This email looks very similar and is consistent with actual emails from IONOS, so it makes it easy to be fooled into believing it's real and being tempted to click on the Validate Your Webmail button.
In fact, there are only 2 giveaways that reveal this is a phishing email and that it's harmful: 1) the from email is from my own email address, which makes no sense (why would I send myself a notice from IONOS?!?), and 2) the Validate Your Webmail button actually links to a site that is not at all related to IONOS.
The clear goal of this phishing attempt is for people to click on the Validate Your Webmail button. To avoid any potential security or intrusion issues, I did NOT click on that button to see where it goes, but I can make an educated guess that it would link to a website either pretending to be an IONOS login page and / or a form requesting additional info. The biggest win for the hackers would be to get an actual IONOS customer's username and password. Second best would be acquiring their personal info, like birthdate, address, credit card info, and other personal info that can be used against them or to pretend that they are them (ie, info that is specific, like a spouse's name).
The bottom line is, do NOT click on any link in an email that you do not 100% trust. In nearly every case, whatever task you are being asked to do can be accomplished by going directly to that company's website. In fact, just to be sure myself, I logged into my IONOS control panel to find out everything was fine – there were no issues with my Webmail and nothing I needed to do.
For any of our clients under an active Security & Maintenance plan, we are happy to evaluate and advise you on any suspicious emails you receive. We will take a look and let you know if an email you receive is legitimate or not and any actions you should take. Occasionally, legitimate emails can be mistaken for phishing attempts and we can help you make the safe choice.
So, as we like to tell our clients: "when in doubt check it out." And if you have ANY doubts, do not click on any links or even reply to an email you suspect as being fake. Contact the company directly or go to their website directly.
Remember, knowledge and caution are the best defenses against phishing attacks and hackers!!
Stripe Climate member