Email Phishing Explained
What is Email Phishing Definition
‘Phishing’ is a cyberattack in which email is the weapon. Victims are tricked into thinking an email is from a legitimate source. The email then lures them into taking some action, either providing sensitive data, downloading a file or simply clicking a link.
The term “Phish” is pronounced as it’s spelled. It’s an analogy for fishing: casting out baited hook hoping someone bites. The term first arose in the mid-1990s making it one of the oldest types of cyber attacks around. Unfortunately, it’s very still lucrative and as a result remains one of the most popular types of cyberattack globally.
A phishing attack is often just a ‘foot in the door’ for a hacker, and if it’s successful it can lead on to more devastating results for an organisation; stolen funds, IP, customer data all of which lead to lost reputation and consumer trust.
Many of the most famous hacks in history, began life as humble phishing attacks…
Real-life examples of successful Email Phishing attacks
- Hilary Clinton’s email woes all started when her campaign chairman was duped into handing over his gmail password.
- Sony’s hack can be traced to top execs who responded to a fake Apple ID verification email which hackers used to guess their work logins.
- Walter Stephan holds the record though. He’s the individual who lost the most from a single phishing email – $47 million. What’s worse is that it was a ‘Fake President incident’.
What is a Phishing Kit? A phishing kit is simply a bundle of web resources and tools that a hacker installs on a server to send out emails to mailing lists of victims. The ready availability of Phishing kits on the Dark Web means that criminals need not have any technical skills to launch successful phishing campaigns to millions. This ease of use is one of the main reasons why the number of emails in circulation just keeps growing.
What is Spear Phishing? In the more sophisticated attacks, hackers will masquerade as somebody the target will plausibly trust like a real person from a company they do business with. They’ll be asked to provide sensitive data such as banking and credit card details, and passwords.
The four patterns that catch Australian businesses
Phishing has narrowed considerably. Most of what actually lands in Australian inboxes falls into four recognisable patterns, and knowing them is more useful than a general warning to be careful.
Credential harvesting. A message that looks like a Microsoft 365 or Google sign-in prompt, usually framed as an expiring password, a shared document or a quarantined message. The link leads to a convincing copy of the login page. This is the single most common starting point for a business email compromise.
Business email compromise and invoice fraud. Once an attacker is inside a mailbox they read for a while, then insert themselves into a real conversation about a real invoice and change the bank details. Because the thread is genuine and the tone is right, these are very hard to spot, and they are where the money is actually lost.
Multi-factor fatigue. The attacker already has the password and repeatedly triggers approval prompts until someone taps accept to make the notifications stop. Number matching and phishing-resistant methods are the countermeasure.
Consent phishing. Rather than stealing a password, the message asks you to grant a malicious application permission to read your mail. No credential is captured, so a password reset does nothing, and multi-factor authentication does not stop it. Controlling which applications users may consent to is what does.
What actually reduces phishing risk
Training alone does not solve this, because the good ones are genuinely convincing. Layer the technical controls underneath it.
- Multi-factor authentication on everything internet-facing, preferably phishing-resistant, so a captured password is not enough.
- Restrict application consent, so a user cannot grant a malicious app access to their mailbox without an administrator approving it.
- Configure SPF, DKIM and DMARC properly on your own domain, so attackers cannot impersonate you to your customers. Many Australian businesses have these records present but in monitoring mode, which does not block anything.
- Alert on mailbox rule creation. One of the first things an attacker does after taking a mailbox is create a rule that hides replies. That single alert catches a large share of business email compromise before the money moves.
- Make reporting easy and blameless. The fastest detection in most organisations is an employee saying “this looks odd”. That only happens if people are not afraid of looking silly.
Finally, put a verification step on payment changes that does not use email. A phone call to a known number, not the one in the message, stops invoice fraud better than any filter.
Siege Cyber runs employee phishing testing that shows you which staff need support, not which staff to blame. Siege Cyber delivers security awareness training built around the attacks Australian businesses actually see. Get a Fixed-Price Quote.