During the first half of 2020, cybersecurity analysts and security experts have discovered that most of the phishing attacks conducted through the use of spoofed login pages. Polymorphic phishing attacks are on the rise in recent times as hackers are coming up with new ways to create spoofed login pages that are almost unidentifiable. This is one of the most frequently used methods implemented by cybercriminals for stealing the credentials of employees and users.Researchers have disclosed that more than 50,000 spoofed login pages replicating 200 popular international brands have been circulating since 2019.
This sudden increase in the number of polymorphic phishing attacks is because spoofed login pages are extremely difficult to identify but are comparatively easier to generate by hackers. Automated phishing kits that are illegally sold over the dark web, are deployed by cybercriminals to instigate these malicious phishing campaigns and to trick employees on a wider scale. This is why phishing awareness and training has become absolutely imperative in organizations in the 21st Century. As a CISO or CIO of your company, taking adequate precautions to prevent polymorphic phishing attacks is the need of the hour.
All you need to know about Polymorphism
In a polymorphic phishing attack, attackers usually make minor alterations in the sender ID of a valid source or spoof an email address. They use social engineering attack techniques to make sure that the spoofed email ID replicates the authentic ID. The hackers then send these malicious emails to the employees in reputed organizations. More often than not, the email lands into the inbox of employees due to the lack of proper email authentication protocol in the company.
This malicious email comes with a link or attachment that redirects the employee to a spoofed login page. The login page asks for the employees’ corporate credentials and passwords. Ill-informed and unaware employees can easily fall for such polymorphic phishing attacks and give up their company login credentials on the spoofed page.
This information is used by hackers to extract valuable data of the company, gain access to company assets and financial information, find out personal details of employees working in the company, and conduct other fraudulent activities.
42% of all phishing attempts in 2020 were as a result of Polymorphism, as per a global survey conducted by security researchers.
According to security officials around the world, while these login pages are fraudulent in nature, they look extremely similar to original webpages. This is why cyber attackers use Polymorphism techniques to phish employees via spoofed login pages and succeed at it.
A cybercriminal can make minuscule changes in the email address so as to replicate a popular brand as closely as possible to skip detection. Since the changes made are very minor, such emails easily evade email security checkers, and email security tools may fail to detect them.
The most probable reasons for the increase in the number of spoofed login pages may be due to the following two reasons:
- CISOs, CIOs, and SOC analysts of the reputed brand whose landing page has been spoofed seek ways for taking the fake pages down. This makes the hackers create more new pages so that it can continue to spoof employees.
- Certain brands or companies may be an easy target for cybercriminals due to the lack of a well-rounded workplace security policy in their organization. This is the reason why attackers get away with polymorphic phishing attacks.
How to Detect Spoofed Login Pages?
While it may be difficult to detect spoofed login pages and prevent being phished, there are certain ways by which one can attempt to understand whether a login page is from an authentic source or not. Before being redirected to a login page it is always advisable to check whether the email is from a valid IP address as well.
This can be done by paying attention to the domain name and subdomains, as attackers might make minor changes in the same to trick employees. It also advisable to check whether the email has a relevant subject, is grammatically correct, and doesn’t provide lucrative offers or instigate a sense of urgency. After making sure of these pointers and clicking on the URL in the attachment when the login page opens up, employees must make sure:
- While hovering over the URL it is redirecting them to the desired page
- The login page is well-designed and all the hyperlinks on the page are fully functional and redirect them to the desired pages
- The URL of the webpage is secured over HTTPS
- The page doesn’t ask them to disclose their corporate credentials or bank account details and password since such information should never be submitted on external platforms
Polymorphic Phishing Attack Prevention and Solution
As a CISO in your company, implementing a robust cybersecurity policy in your organization is imperative. To achieve this, security analysts may take help from the IT department and implement security solutions and tools in their respective organizations. A phishing attack awareness and training program can help employees to gain better insights on social engineering attack vectors. Proper awareness among employees can reduce the chances of polymorphic phishing attacks.
A cyber attack awareness and training program starts working by simulating sophisticated impersonations of real-life cyber attacks on a company’s employees. A number of simulations are perpetrated to increase security awareness.
After this, the training procedure is initiated, by imparting knowledge on the various types of attack vectors. This is done through awareness content giving detailed insight on them, visual presentations on attack identification, as well as video lectures and advisories on the same. Regular cumulative assessments are then taken to ensure improvements and initiate a better response against attacks.
Detailed analysis of simulation reports is provided to track results and monitor progress made via assessments and knowledge imparting sessions taken by employees.
In order to prevent employees from falling prey to phishing attacks, it is imperative for CISO and security officials to implement AI-driven cybersecurity solutions. By upgrading your workplace cybersecurity policy and implementing leading-edge cybersecurity solutions in your company, it is possible to ensure protection against polymorphic phishing attacks.
