Phishingpedia
PhishingU's comprehensive knowledge center
Everything you need to know about phishing attacks, social engineering and information security
* One allowlisting action by your IT team is required, and launch is subject to a security review of up to one business day.
Articles
What is a phishing attack?
Phishing is an online attack method based on social engineering, in which attackers impersonate a trusted party in order to steal sensitive information such as passwords and credit card details, or to cause malware to be installed. The term derives from the English word 'fishing', since attackers 'cast a lure' and hope the victim will 'bite'. Phishing attacks are one of the most significant threats to enterprise information security, and a large share of attacks begin with phishing or human error.
Email phishing
Email phishing is the most common type of phishing attack. Attackers send emails that impersonate legitimate organizations such as banks, delivery companies, cloud services or even the company you work for. The emails usually contain a link to a fake website that looks identical to the original, or a malicious attachment. Warning signs include: a suspicious sender address, artificial urgency ('Act now!'), spelling mistakes, a request for sensitive information, and links that do not match the real address when you hover over them with the mouse.
Spear phishing
Spear phishing is an advanced type of phishing attack in which the attacker targets a specific person or organization. Unlike regular phishing that is distributed en masse, in spear phishing the attacker invests time in in-depth research on the target: their role, business contacts, interests and personal details that can be found on social networks. The malicious email looks personal and especially relevant, which significantly increases the chance that the victim will fall for it. These attacks are especially dangerous because they are harder to recognize.
Whaling
Whaling is a type of spear phishing aimed at senior executives in the organization - the CEO, CFO, CTO and directors. These 'whales' are especially attractive targets because they have access to critical information, large fund-transfer authority and significant business decisions. Whaling attacks are especially sophisticated and sometimes include impersonating other senior figures in the organization or business partners. For example: a fake email from the CEO to the finance manager asking for an urgent fund transfer.
Smishing - SMS phishing
Smishing (SMS + phishing) is a phishing attack carried out through text messages (SMS). These messages impersonate banks, delivery companies, government authorities or popular services. The message usually includes a fake link or a phone number to call. Common examples: 'Your package is waiting - click here', 'Your account has been blocked - act immediately', 'You won a prize - visit the site'. Smishing is especially dangerous because people tend to trust SMS messages more and open them immediately from a mobile device.
Vishing - voice phishing
Vishing (voice + phishing) is the use of phone calls for social engineering and for extracting sensitive information. The attacker impersonates a bank representative, technical support, a government authority or a service provider. Using psychological manipulation - creating urgency, fear or authority - they persuade the victim to hand over personal information, passwords or to perform certain actions on the computer. Caller ID spoofing technologies are sometimes used so that the call appears to come from a legitimate source. Vishing is especially effective against older populations or people who are not tech-savvy.
Clone phishing - duplicating emails
Clone phishing is a technique in which attackers clone (copy) a legitimate email the victim received in the past, and replace the links or attachments with malicious versions. The attacker sends the cloned email from an address very similar to the legitimate source, with an excuse such as 'resending' or 'updated version'. Because the email looks familiar and the recipient remembers receiving it before, the chance that they will open the malicious file or click the fake link is significantly higher. This is a sophisticated attack that requires access to the victim's mailbox or the ability to see previous correspondence.
Social engineering
Social engineering is an attack method that exploits human weaknesses instead of technological weaknesses. Attackers use psychological manipulation to get people to reveal information, perform actions or violate security procedures. Key principles in social engineering: (1) authority - impersonating an authority figure, (2) urgency - creating time pressure, (3) fear - a threat of harm or loss, (4) curiosity - an interesting lure, (5) helpfulness - exploiting the desire to help. Social engineering is the basis of all phishing attacks, so the most important protection is employee training and awareness.
BEC - Business Email Compromise
BEC (business email compromise) is a sophisticated attack in which attackers impersonate senior executives or business partners in order to cause a fund transfer or the exposure of sensitive information. For example: an attacker sends an email from the CEO's spoofed address to the finance manager, asking to urgently transfer a sum of money to a 'new' supplier. BEC attacks cause enormous financial damage - according to the FBI, they are responsible for losses of billions of dollars every year. Protection includes: employee training, verification processes for fund transfers, and multi-channel verification for unusual requests.
Pharming - redirecting to fake websites
Pharming is an attack in which attackers redirect users to fake websites without them having to click a suspicious link. This is done by changing DNS settings on the victim's computer or on a DNS server. So when the user types their bank's address (for example), they are redirected to a fake website identical to the original. Unlike regular phishing, the victim makes no mistake - they type the correct address! Protection from pharming includes: using HTTPS (a padlock in the browser), updated antivirus, caution when downloading software, and using trusted DNS servers.
Credential harvesting - stealing access credentials
Credential harvesting is the main goal of most phishing attacks. Attackers create fake login pages that look identical to the real services (Gmail, Office 365, Facebook, the company website), and the user enters their username and password. The credentials are sent directly to the attackers. They can then use these credentials to log in to real accounts, steal information, transfer money, or spread the attack further. Protection: two-factor authentication (2FA), a password manager, caution with login links in emails, and checking the real website address.
Malware distribution
Distributing malware is another common goal of phishing attacks. Attackers persuade the victim to download and run an email attachment or a download button on a fake website. Common types of malware: (1) ransomware - encrypts files and demands a ransom, (2) trojans - allow remote access to the computer, (3) keyloggers - record keystrokes, (4) spyware - collects information and sends it to attackers. Protection: updated antivirus, not running files from unfamiliar sources, regular backups, and limiting user permissions.
Learning the warning signs of phishing
Recognizing phishing attacks is the first line of defense. Main warning signs: (1) a suspicious sender address - small differences in spelling, (2) artificial urgency - 'Act now or your account will be locked!', (3) spelling mistakes and poor wording, (4) a request for sensitive information - no legitimate organization will ask for passwords by email, (5) suspicious links - hover over the link to see the real address, (6) unexpected attachments - especially .exe, .zip, .js, (7) a generic greeting - 'Dear customer' instead of your name, (8) offers that are too good to be true. Golden rule: if in doubt, contact the organization through another channel (phone, official website) to verify.
Two-factor authentication (2FA) as protection
Two-factor authentication (2FA) is the most important layer of protection against phishing. Even if an attacker managed to steal your password, they cannot log in to the account without the second factor. Types of 2FA: (1) SMS - a code sent in a text message (the least secure), (2) an authenticator app - such as Google Authenticator or Microsoft Authenticator (recommended), (3) a physical key - YubiKey, Titan (the most secure), (4) biometrics - fingerprint, face recognition. It is important to enable 2FA on all critical services: email, banking, social networks, work systems. It significantly reduces the risk even in the case of a successful phishing attack.
Employee awareness training
Employee training is the most important line of defense against phishing, because a large share of attacks exploit human error. What effective training should include: (1) clear explanations of the types of attacks and how they work, (2) hands-on practice - real phishing simulations, (3) immediate feedback - training at the moment of the mistake, (4) periodic updates - new threats, (5) a security culture - encouraging reporting of suspicions without fear of punishment, (6) examples relevant to the work environment. Organizations that run training and exercises regularly usually report an improvement in recognition, but results vary between organizations.
Phishing simulations in the organization
Phishing simulations are the most effective way to prepare an organization for real threats. How it works: (1) sending controlled phishing emails to employees - they look completely real, (2) tracking who opened, clicked or entered information, (3) focused training for those who failed, (4) detailed reports for management, (5) measuring improvement over time. Advantages: (a) identifying weak points, (b) a practical and safe experience, (c) building a security culture, (d) documentation that helps meet part of the requirements of standards such as ISO 27001 and SOC 2 (this is not a confirmation of full compliance), (e) documentation for management and the board about investment in security. PhishingU specializes in simulations tailored to each organization, with a professional red team and realistic campaigns.
Security standards and phishing
Many organizations are required to provide awareness training and to deal with phishing under standards such as ISO 27001, SOC 2, HIPAA, PCI-DSS, GDPR and the Israeli Standard 361, as well as Amendment 13 to the Privacy Protection Law. The requirements vary according to the type of organization and the standard, so it is worth checking with your legal advisor or auditor what applies to you. The standards emphasize regular training, a clear security policy and incident response processes. Running phishing exercises and documenting them is evidence that helps meet part of the requirements, and it is not a confirmation of full compliance with a law or a standard.
The economic cost of phishing attacks
The economic impact of successful phishing attacks is devastating. The costs may be significant and vary between incidents. They include: (a) direct damage - theft of funds, ransom, (b) business downtime, (c) regulatory fines, (d) legal expenses, (e) reputational damage, (f) loss of customers, (g) the cost of restoring systems. By comparison, the investment in simulations and training is small - usually low relative to the potential damage of an incident.
Case studies - famous phishing attacks
Famous cases that illustrate the danger: (1) Target (2013) - phishing of an HVAC supplier led to the theft of 40 million credit card records, cost: $162 million, (2) Sony Pictures (2014) - phishing of employees led to a massive breach and a leak of embarrassing information, (3) Google and Facebook (2013-2015) - a $100 million BEC fraud by someone impersonating a supplier, (4) Twitter (2020) - phishing of employees led to the takeover of accounts of prominent figures. Lessons: (a) no organization is immune, (b) a single employee can endanger the whole organization, (c) attackers are patient and persistent, (d) the investment in training is small compared with the potential damage.
The future of phishing - AI and new technologies
Phishing attacks are becoming more sophisticated as technology advances: (1) AI and chatbots - creating convincing, personal content at scale, (2) deepfakes - fake video and audio of executives, (3) automated attacks - bots that adapt themselves to the victim, (4) exploiting social networks - personal information is accessible to everyone, (5) IoT - attacks through smart devices. Future protection will require: (a) integrating AI for defense - identifying suspicious patterns, (b) advanced biometric authentication, (c) zero trust architecture - constant verification, (d) advanced training - including deepfakes. The most important weapon will remain: aware and alert employees.
Phishing exercises for senior executives (whaling)
Phishing exercises for senior executives (whaling simulations) are a critical part of the organizational protection program. Senior executives - the CEO, CFO, COO and directors - are especially attractive targets for attackers because of their access to critical information, fund-transfer authority and familiarity with business partners. Whaling exercises include: (1) advanced impersonation simulations - emails impersonating other directors, legal advisors or business partners, (2) BEC scenarios - urgent and 'confidential' fund transfer requests, (3) complex social engineering - exploiting schedules, business travel and business discussions, (4) multi-channel attacks - a combination of email, SMS and phone calls. These exercises are especially important because: (a) senior executives sometimes skip training, (b) they are less careful because of time pressure, (c) a mistake by them can be fatal to the organization, (d) there is a need to prove directors' responsibility for information security.
Directors' and companies' liability in phishing
The responsibility of directors for information security and phishing is a subject that concerns many organizations. Under the law that applies to the organization, directors may have a duty of care toward the company, including with regard to cyber risks, and a cyber incident may lead to lawsuits, regulatory fines and reputational damage. The content is general and is not legal advice, and we recommend checking with your legal advisor what applies to you. Common steps: requesting periodic security reports, approving an appropriate security budget, going through dedicated phishing exercises, and making sure there are clear policies and procedures. A periodic cyber management exercise and its documentation are evidence that the organization acted to reduce risks, and they are not a confirmation of compliance with a legal duty.
Using AI to create advanced phishing scams
Artificial intelligence (AI) is revolutionizing the world of phishing and making attacks many times more sophisticated, personal and hard to recognize. Uses of AI in phishing scams: (1) creating convincing content - ChatGPT and LLMs create emails without spelling mistakes, in natural, professional language, (2) personalization at scale - AI analyzes social network profiles and creates personalized messages for thousands of targets, (3) voice and video deepfakes - creating fake phone calls of executives, and videos of a CEO asking for a fund transfer, (4) solving CAPTCHAs - bypassing automatic protection mechanisms, (5) adaptive attacks - bots that learn from responses and improve themselves in real time, (6) automated vishing - malicious IVR systems that imitate customer service. Protection from AI phishing: (a) advanced training - learning to recognize deepfakes, (b) multi-channel verification - always verify unusual requests by phone or face to face, (c) zero trust - never rely only on an apparent source, (d) AI for defense - using AI tools to identify attack patterns, (e) a clear policy - approval processes for fund transfers that cannot be bypassed. The race between attacking AI and defending AI is only beginning.
Cyber scenarios: dealing with BEC attacks
Business email compromise (BEC) is one of the most dangerous and expensive cyber scenarios, with global losses of billions of dollars a year. A typical BEC scenario: (1) preliminary research - the attacker collects information about the organization, senior executives and suppliers through LinkedIn, the company website and social networks, (2) impersonation - creating an email address very similar to a senior executive (CEO, CFO) or a legitimate supplier, (3) building trust - innocent initial correspondence to build credibility, (4) the attack - an urgent, confidential request to transfer money to a new account for a supplier, an investment or a deal. Common variations: (a) CEO fraud - impersonating the CEO, (b) invoice fraud - changing the account details of a real supplier, (c) impersonating a legal advisor - urgent confidential requests, (d) supply chain compromise - impersonating a known supplier. Protection and handling of a BEC scenario: (1) verification processes - every money transfer request must go through phone verification from a number known in advance, (2) segregation of duties - no single person can approve a transfer alone, (3) approved lists - changing account details requires a separate, verified process, (4) cyber scenario training - practicing the response to urgent situations, (5) a culture where it is okay to ask - encouraging employees to verify unusual requests. An annual cyber exercise for dealing with BEC is critical.
A business continuity and disaster recovery exercise: the importance of phishing simulation
A business continuity planning (BCP) exercise and a disaster recovery (DR) exercise must include phishing scenarios as a central part of preparing for cyber incidents. Why are phishing simulations part of business continuity? (1) A large share of cyber incidents begin with phishing - a successful phishing attack is sometimes the 'disaster' itself, (2) response time is critical - quickly recognizing phishing can prevent a bigger disaster, (3) practicing the response - employees need to know what to do when they recognize or fall for phishing, (4) testing procedures - is the IR team ready? Are there backups? Can systems be restored? Integrating phishing into BCP/DR: (a) multi-stage scenarios - a phishing simulation → breach → ransomware → data encryption, (b) a communication check - can you alert and communicate during an incident? (c) practicing backup and recovery - can systems be restored after an attack? (d) a blue team check - does the security team recognize the abnormal activity in the SIEM? (e) damage assessment - what is the business impact? What are the recovery times? An annual combined phishing + BCP exercise allows: an end-to-end test of the recovery capability, identifying weaknesses in processes, training employees to respond correctly, and proof to the board and regulators of organizational readiness. This is a critical investment in the organization's resilience.
Awareness of password exposure and managing access credentials
Password exposure is one of the most common and dangerous results of successful phishing attacks. The dangers of password exposure: (1) access to critical systems - an attacker can log in as a legitimate user, (2) credential stuffing - using the same password on different systems, (3) privilege escalation - using credentials to obtain higher permissions, (4) prolonged access - sometimes an exposure is discovered only after months. Prevention and protection procedures: (a) a strong password policy - minimum length, complexity, periodic replacement, (b) an organizational password manager - tools such as 1Password, LastPass, Bitwarden, (c) two-factor authentication (2FA) - mandatory on all critical systems, (d) multi-factor authentication (MFA) - a combination of password + SMS/app + biometrics, (e) SSO (single sign-on) - reducing the number of passwords, (f) automatic expiry - ending sessions after a period of inactivity. Employee awareness: (1) not sharing passwords - ever, not even with IT, (2) caution with 'reset password' links - verify against the real website, (3) immediate reporting of a suspected exposure, (4) using unique passwords - not the same for work and private use. Monitoring and early detection: Have I Been Pwned checks, dark web monitoring, alerts on suspicious login attempts, and regular log review. Password exposure is the gateway to bigger disasters - prevention is the key.
Identifying and reporting abnormal activity and sensitive information
Identifying abnormal activity and the exposure of sensitive information to an unauthorized party is the last line of defense before a full disaster. What is abnormal activity? (1) access attempts at unusual hours, (2) access to systems or files that are not relevant to the role, (3) massive data downloads, (4) changes to user permissions, (5) changes to systems without approval, (6) communication with suspicious IP addresses. Sensitive information includes: (a) personally identifiable information (PII), (b) financial information, (c) intellectual property, (d) trade secrets, (e) customer data, (f) security details. Why do employees not report? (1) fear of punishment - 'it's my fault that I clicked', (2) lack of awareness - they do not recognize that something is unusual, (3) organizational culture - there are no clear reporting channels, (4) time pressure - 'I don't have time to deal with this'. Building a reporting culture: (a) simple and accessible channels - a 'report phishing' button in the email client, (b) no punishment - encouraging reporting even after a mistake, (c) a quick response - feedback to the reporter within hours, (d) recognizing the contribution - publishing successes (anonymously), (e) regular training - what to look for? How to report? Detection tools: SIEM (security information and event management), DLP (data loss prevention), UBA (user behavior analytics) and EDR (endpoint detection and response) systems. An employee who reports early can save the organization millions of dollars in damage - this is an asset and not a weakness.
Employee training on cyberattacks and phishing exercises
Comprehensive employee training on cyberattacks is the investment with the highest ROI in information security. Why is training important? A large share of cyberattacks succeed because of human error - technology alone is not enough. What should effective training include? (1) information security basics - what is phishing? What is ransomware? What is social engineering? (2) recognizing threats - warning signs in emails, links and suspicious phone calls, (3) hands-on practice - real phishing exercises, BEC simulations, whaling scenarios, (4) procedures and processes - what to do when you recognize a suspicion? How to report? (5) relevant examples - cases from your industry, recent attacks, (6) passwords and authentication - using 2FA, password managers, (7) mobile devices - BYOD risks, smishing, malicious apps, (8) working from home - securing Wi-Fi networks, VPN. Phishing exercises (phishing simulations): (a) sending controlled phishing emails - they look completely real, (b) measurement - who opened? Who clicked? Who reported? (c) immediate feedback - training at the moment of the mistake = experiential learning, (d) tracking over time - is there improvement? (e) reports for management - weak points and risks. Frequency and methodology: quarterly training is a must, phishing exercises every month or two, updates about new threats as needed. Important: training cannot be 'done and dusted' - it is an ongoing investment. Results: organizations that run training and exercises regularly usually report an improvement in recognition, but results vary between organizations.
Cyber insurers' requirements for email security and phishing exercises
Many cyber insurers ask the organization for information about security measures before offering or renewing a policy, including on email security and employee training. The requirements vary between insurers and policies, so you should check with the insurer what is required. Examples of topics insurers tend to ask about: (1) phishing exercises, employee training and documentation of participation, (2) email infrastructure security: SPF, DKIM, DMARC and filtering of spam and malware, (3) multi-factor authentication (MFA), (4) an incident response plan, (5) monitoring and control, (6) backups and restore testing, (7) periodic risk assessment. PhishingU issues a completion certificate that documents the carrying out of the exercise: the date, the number of participants, the types of scenarios, results and recommendations. The certificate is evidence of training that was carried out, which insurers may ask for. The decision whether to accept it and on what terms remains with the insurer.
How to get a discount on a cyber insurance policy with phishing exercises
Documentation of phishing exercises and employee training may help in a conversation with the insurance company. Insurance companies assess the organization's risk level and price accordingly, so presenting documentation of awareness activity is part of the picture. There is no promise of a discount or a cheaper policy: this varies between insurers, and the decision is with the insurer alone. Documentation that insurers tend to ask for: (1) documented phishing exercises, (2) an improvement trend over time, (3) a documented training program, (4) email security infrastructure (SPF, DKIM, DMARC, MFA), (5) an incident response plan. We recommend contacting the insurer, presenting the certificate and the reports, and finding out what they require. The investment in phishing exercises pays off regardless of insurance, because it reduces the chance of a cyber incident.
Incident response (IR) exercises - preparing to handle cyber incidents
Incident response (IR) exercises are simulations of real cyber incidents whose purpose is to prepare the organization for a fast and effective response when a real security incident occurs. What is an IR exercise? An exercise that simulates a scenario of a breach or cyberattack, tests the response of the security and operations teams, and evaluates the effectiveness of incident response procedures. Why is it critical? (1) response time - every minute is critical: organizations with regular IR exercises reduce response time by a third on average, (2) team coordination - testing communication between the IT team, the security team, management and legal, (3) testing procedures - do the incident response procedures work in practice? (4) identifying gaps - discovering missing tools, wrong permissions or communication problems. Types of IR exercises: (a) tabletop exercise - a theoretical discussion with no technical execution, (b) walkthrough - a partial simulation with certain steps carried out, (c) full-scale drill - a full exercise with a complete simulation of an attack. Common scenarios for IR exercises: a ransomware attack, successful phishing with credential exposure, DDoS, a breach of a production system, a leak of sensitive information, a malware infection, a shutdown of critical systems. Stages of a typical IR exercise: (1) preparation - defining the scenario and the exercise goals, (2) kickoff - presenting the scenario to the teams, (3) detection - testing the identification of the incident, (4) analysis - analyzing the scope of impact, (5) containment - isolating the threat, (6) eradication - removing the threat, (7) recovery - restoring systems, (8) post-incident review - summarizing lessons. Measurable benefit: (a) reducing detection and containment time (dwell time), (b) reducing incident costs, (c) improving team coordination, (d) updating and improving procedures. Standards requirements: ISO 27001, SOC 2, NIST CSF, PCI-DSS and many other regulations require periodic IR exercises. Recommended frequency: at least twice a year - a quarterly tabletop exercise and a half-yearly full-scale exercise. PhishingU's IR exercises include: a real attack simulation with full coordination with the blue team, testing the SIEM and monitoring tools, testing communication and escalation procedures, identifying gaps and shortcomings, a detailed report with operational recommendations. IR exercises are not just a checkbox for compliance - they can save the organization millions of dollars in damage.
Tabletop exercise (TTX) - management exercises for cyber incidents
A tabletop exercise (TTX) is a structured simulation exercise to test the response of senior management to a severe cyber incident. Unlike technical IR exercises, a TTX focuses on decision-making at the managerial and strategic level. What is a TTX? A scheduled meeting of senior management (CEO, CFO, CTO, CISO, department heads, legal advisors) to discuss and respond to a simulated cyber scenario. Goals of a TTX: (1) testing decision protocols at the top level, (2) practicing communication between management and the technical teams, (3) examining critical business decisions - whether to pay a ransom? When to publish? How to communicate with customers? (4) understanding legal and regulatory implications, (5) practicing external communication - media, customers, regulators. Why is a TTX critical? Many senior management teams are not ready to make decisions in a severe cyber incident. A TTX exposes gaps in understanding, processes and communication before they become a real problem. A typical TTX structure: (1) pre-brief - presenting the scenario and the rules (60-90 minutes), (2) inject 1 - discovery of the initial attack, (3) discussion and decisions - the initial response, (4) inject 2 - the situation worsens (a leak to the media / wider impact), (5) discussion and decisions - full crisis management, (6) inject 3 - further consequences (lawsuits / fines), (7) hot wash - summarizing lessons and recommendations. Common TTX scenarios: ransomware with a shutdown of production systems for several days, a leak of sensitive information of millions of customers, a successful BEC with the transfer of millions of dollars to attackers, a supply chain attack through a trusted supplier, a breach with the theft of IP and trade secrets. Critical decisions in a TTX: (1) whether to pay a ransom? (2) when and how to report to regulators (72 hours under GDPR), (3) communication to customers and partners, (4) media communication, (5) activating cyber insurance, (6) legal considerations - exposure to class actions, (7) business continuity - how to continue operating? Measurable benefit of a TTX: identifying gaps in top-level decision processes, improving communication between management and technical teams, understanding business and legal implications, preparing communication plans in advance. Standards and regulatory requirements: NIST guidance, the SEC (America), the Israel Securities Authority, and growing regulations require directors to prove involvement and preparation for cyber incidents. A TTX is the central tool for proving directors' responsibility. Recommended frequency: at least once a year for the board and top management. PhishingU's TTX is adapted to the organizational culture and language, delivered by experienced cyber experts, includes industry-specific scenarios, ends with a detailed executive-level report, and provides a formal confirmation to the board.
Directors' liability: the duty to carry out IR and TTX exercises
Directors have a duty of care toward the company, and it may include addressing cyber risks. The scope of the liability and the duties depend on the law that applies to the organization (for example the Companies Law, securities law and industry regulation), and the content here is general and is not legal advice. We recommend checking with your legal advisor what applies to you. Incident response (IR) exercises and tabletop exercises are an accepted way to prepare for a cyber incident. Documenting the carrying out of exercises, lessons and corrective actions is evidence that the board and management acted to reduce risks, and it is not a confirmation of compliance with a legal duty and does not guarantee protection from lawsuits. Sources worth consulting: guidance from the Privacy Protection Authority, guidance from regulators in your field, and the insurer's guidance. A PhishingU completion certificate documents the carrying out of the exercise, including recommendations for improvement, and helps meet part of the requirements.
DMARC - protection from email spoofing
DMARC (Domain-based Message Authentication, Reporting & Conformance) is a critical security protocol that protects your domain from email spoofing and brand impersonation. What is DMARC? DMARC builds on SPF and DKIM and adds two important capabilities: (1) policy - what to do with emails that fail authentication (quarantine/reject), (2) reporting - detailed reports on all emails sent in the domain's name. Why is DMARC critical? (a) preventing phishing - attackers cannot send emails in your company's name, (b) protecting reputation - malicious emails in your domain's name harm customers' trust, (c) a regulatory requirement - large email providers (Gmail, Yahoo, Microsoft) require DMARC, (d) protection from BEC - significantly reduces internal impersonation attacks. The three levels of DMARC policy: (1) none (p=none) - monitoring only, no effect on emails, (2) quarantine (p=quarantine) - sending suspicious emails to spam, (3) reject (p=reject) - completely rejecting emails that failed authentication. Recommendation: start with none to collect data, move to quarantine, and finally to reject. DMARC reports - the hidden asset: DMARC sends daily reports (XML) that contain: (a) every source sending emails in the domain's name, (b) whether the emails pass SPF/DKIM, (c) the volume of emails by source, (d) detection of spoofing attempts in real time. Following DMARC reports allows: identifying legitimate email providers that need to be added to SPF, discovering brand impersonation attempts as soon as they begin, monitoring the health of the email infrastructure, and proof to regulators and insurers of active protection. Report analysis tools: Postmark, Dmarcian, Valimail, MXToolbox - they present the reports in a visual and easy-to-understand way. The DMARC implementation process: (1) adding a TXT record in the domain: _dmarc.example.com, (2) starting with p=none for 2-4 weeks, (3) analyzing the reports and identifying legitimate sources, (4) fixing SPF/DKIM for missing sources, (5) moving to p=quarantine for a month, (6) a final move to p=reject for maximum protection. Common mistakes: not monitoring DMARC reports - without monitoring there is no value, SPF/DKIM not set up correctly, moving too quickly to reject and blocking legitimate emails. DMARC with a reject policy makes it very hard to impersonate the organization's domain in email messages. PhishingU recommends implementing DMARC in every organization. It is not only technical protection - it is a statement that you take email security seriously.
Security awareness training - raising information security awareness
Security awareness training is an ongoing process of educating employees to recognize and avoid cyber threats. Why is awareness training critical? Employees are the weakest and the strongest link: a large share of cyberattacks succeed because of human error, but aware employees can recognize and report threats before they cause damage. What does effective awareness training include? (1) knowing the threats - phishing, ransomware, BEC, social engineering, smishing, vishing, (2) recognizing warning signs - suspicious links, urgent requests, spelling mistakes, requests for sensitive information, (3) response procedures - what to do when you recognize a suspicion? How to report? Whom to contact? (4) password security - creating strong passwords, using a password manager, two-factor authentication, (5) device security - locking computers, safe remote work, BYOD, (6) information security - information classification, secure sharing, backups. Scenarios unique to the organization: effective training must be relevant - examples from your industry, role-specific scenarios (the finance department differs from human resources), current threats. Experiential learning - the key to success: theoretical training alone is not enough. The human brain learns best from experiences. That is why phishing exercises (phishing simulations) are the most effective tool: (a) employees experience a realistic attack in a controlled environment, (b) immediate feedback - training at the moment of the mistake is a strong learning opportunity, (c) measurement - tracking improvement over time, (d) adaptation - adjusting scenarios according to the risk level. Frequency and methodology: annual training as a minimum - quarterly is better, phishing exercises every month or two - a higher frequency = faster improvement, updates about new threats - deepfakes, AI phishing, microlearning - short (5-10 minute) training on specific topics. Measuring success: an improvement in the rate of recognizing phishing in simulations (target: above 80% recognition), an increase in employees' reports of suspicious emails, a decrease in security incidents related to human error. Regulatory requirements: ISO 27001, SOC 2, HIPAA, PCI-DSS, GDPR, Standard 361 - all require documented awareness training. Cyber insurance - most insurers require proof of periodic training. Results: organizations that run training and exercises regularly usually report an improvement in recognition, but results vary between organizations. PhishingU provides: complete awareness training programs that combine theoretical training and realistic phishing simulations, content adapted to the organizational culture and language, role-specific training, detailed reports for tracking improvement, and a completion certificate as evidence of the training carried out, which can help with part of the requirements of standards and insurers.
Why does phishing worry chief information security officers (CISOs) more than any other threat?
Phishing is the nightmare of every CISO (chief information security officer) - and the reason is simple and frightening: it is the only threat that combines human weakness, advanced technology and amazing ease of execution. **Why is phishing still relevant - and more than ever?** Here are the most worrying reasons that raise the level of concern of every security manager: (1) **Human trust - the vulnerability that cannot be fixed technically**: people are programd to trust. When we receive an email from the 'boss', from the bank, or from a familiar supplier, the first reaction is trust, not doubt. This is a basic psychological principle that phishing attackers exploit. (2) **Click culture - habits formed over years**: today we receive dozens to hundreds of emails a day, with dozens of links, files and messages. The automation that has formed - 'I received an email → I clicked a link' - is exactly what attackers look for. An employee working under time pressure, at high speed, is the ideal victim. (3) **AI is revolutionizing the game - phishing at industrial scale**: in the past, creating a phishing campaign targeted at a company required days of research, writing in high-level language and technical knowledge. **Today, with AI tools such as ChatGPT and similar tools, any attacker can produce perfect content, with no mistakes, in professional-level language, personalized for a specific target - within a few minutes**. An attacker can analyze the organization's LinkedIn, see who works where and in which roles, and produce personalized emails for each person. Instead of 10 generic emails - 1,000 targeted emails. (4) **Training gaps - the human factor is not addressed**: although everyone knows training is important, the reality is: most organizations run one security training a year (if at all), employees 'pass' the training without really learning (checkbox training), there is no tracking of improvement or measurement of effectiveness, and training is not updated with new threats (deepfakes, AI). **The result: an enormous gap between the level of the threat and the level of employees' preparation**. (5) **Multiple external channels - the attack surface is expanding**: in the past, email was the main channel. Today every employee is exposed on: LinkedIn (professional social engineering), WhatsApp/Telegram (sophisticated smishing), phone (vishing with a voice deepfake), Slack/Teams (impersonating colleagues), social networks (Facebook, Instagram, Twitter/X). **Every channel is a potential entry point**. A CISO cannot control all of these channels. (6) **Sophisticated attackers with automation and familiar systems**: today's attackers are not amateur hackers. These are organized groups with budgets, advanced tools and orderly work processes. They use: phishing-as-a-service tools (ready-made phishing services), automation for identifying targets and sending emails, OSINT (open source intelligence) tools for collecting information, sophisticated C&C (command and control) servers, AI systems for analyzing responses and dynamic adaptation. **And the frightening part: they use brands and systems you trust - Microsoft, Google, Amazon, your suppliers**. **What to present to the CISO in every management meeting:** (a) **phishing is a common entry point for breaches** - phishing is the 'front door' of every significant attack. (b) **The cost of a data breach may be very high** - and many breaches begin with a single click by an employee. (c) **Many organizations experience phishing attempts** - it is not 'if', it is 'when'. (d) **Phishing is among the main threats** that worry security professionals. (e) **The response to a fake link is usually fast** - so it is important to prepare employees in advance. (f) **Some employees do not report a suspicious email** - so it is worth building a reporting culture. **Why does a CISO not sleep at night?** (1) **They depend on the 'human link'** - you can invest millions in technology, but one employee with one click can bypass everything. (2) **Technology is not enough** - anti-phishing, firewalls, EDR - all great, but sophisticated phishing gets through easily. (3) **Attackers are improving faster than the defense** - AI gives attackers an enormous advantage. They can produce endless variations until something works. (4) **The board asks hard questions** - 'Why didn't you stop this?' 'Why weren't the employees trained?' 'Where is the budget we invested?'. Personal responsibility. (5) **Cyber insurers are tightening their requirements** - if there is no periodic training + documented phishing exercises → the policy is expensive or will not cover incidents. **What is the solution? What does a CISO really need?** (a) **Regular, realistic phishing simulations** - not a checkbox, but real exercises that imitate current threats (AI, deepfake, BEC). (b) **Continuous training with microlearning** - not once a year, but short, focused content on an ongoing basis. (c) **Measurement and tracking** - what is not measured does not improve. You need reports, metrics and tracking of improvement over time. (d) **A culture of 'it's okay to ask'** - employees need to feel safe reporting suspicions and asking questions. (e) **Automation and advanced technological protections** - DMARC, anti-phishing AI, sandboxing, email authentication. (f) **Management and board involvement** - TTX for the board, IR exercises for management, understanding the risk at the top level. **Summary: phishing is not 'just another threat'** - it is the perfect combination of technology, psychology and ease of execution, which makes it the number 1 threat to every organization. The CISO who understands this - invests in training, in exercises, and in building a security culture - is the one who can sleep a little better at night. But only a little.
SocGholish (FakeUpdates) - the most dangerous malware-as-a-service attack of 2024-2025
SocGholish, also known as FakeUpdates, is one of the most sophisticated and dangerous malware campaigns active today. According to 2024-2025 research by leading security companies (Proofpoint, ReliaQuest, Mandiant), SocGholish is responsible for thousands of successful attacks a month and serves as a gateway for ransomware attacks, data theft and espionage operations. **What is SocGholish? Understanding the threat:** SocGholish is a sophisticated malware framework that impersonates legitimate browser updates (Chrome, Firefox, Edge) and lures victims into downloading and running malicious JavaScript code. It is a hybrid threat: it combines social engineering (a 'mandatory' browser update), drive-by download attacks (infection from a legitimate website that was breached), and malware-as-a-service (provided as a service to organized crime groups). **How does the attack work? The infection chain:** (1) **Breaching legitimate websites (watering hole)**: the attacker group (probably Evil Corp or TA569) breaches legitimate websites - news sites, business blogs, popular content sites - and injects malicious JavaScript code. Sometimes through a WordPress vulnerability, vulnerable plugins, or supply chain attacks on external content providers. (2) **Showing a fake update alert**: when a user visits the infected site, the malicious code checks the browser, the operating system and the geographic region. If the target is relevant (an organization, a specific country), a fake pop-up window is displayed that looks identical to a real browser update alert: 'Chrome is out of date. Update now to continue browsing securely.' or 'Critical Browser Update Required'. The design is remarkably accurate - the right logo, identical fonts, familiar UI buttons. (3) **Downloading a malicious ZIP file**: when the user clicks 'Update' or 'Download', a download of a ZIP file starts, with a name such as 'Chrome.Update.zip' or 'Firefox.Setup.zip'. Inside the ZIP - a malicious JavaScript (.js) file wrapped in misleading names such as 'Update.js'. (4) **Execution and infection**: if the user runs the JS file (double-click), the code runs in Windows Script Host and downloads the next-stage payload - usually a Cobalt Strike Beacon or NetSupport RAT. (5) **Post-infection - what happens after?** From this point, the attackers have gained remote control of the device. They can: steal credentials and passwords, perform lateral movement in the network, install ransomware (for example WastedLocker, LockBit), steal sensitive information (IP, customer data, financial documents), turn the device into a bot in a botnet. **Why is SocGholish so dangerous and effective?** (1) **Trust exploitation - exploiting absolute trust**: ordinary users are familiar with browser update alerts - it is a message they see all the time. When it is displayed on a legitimate website you trust (not a suspicious site), the instinctive reaction is to click. There are no clear warning signs. (2) **Legitimate websites as an attack vector**: unlike email phishing, there is no need to get the user to open a suspicious email. The user is already on a site they know and trust. It is a classic watering hole attack - lying in wait where the victim visits anyway. (3) **Bypassing technical protection mechanisms**: (a) **Antivirus bypass**: the JS file uses obfuscation and polymorphism (dynamic code change) techniques so that antivirus signatures do not recognize it. (b) **Sandbox evasion**: the code checks whether it is running in a virtual machine or sandbox, and if so - does not activate itself. (c) **UAC bypass**: using techniques to bypass Windows User Account Control. (d) **No email needed**: there is no suspicious email to filter, no link to check - the attack comes through legitimate websites. (4) **Supply chain reach - massive impact**: SocGholish attacks not only individual websites but content providers, external JavaScript libraries and CDNs. When one provider is breached - thousands of websites that load its code are infected at once. It is a classic supply chain attack. (5) **Malware-as-a-service business model**: SocGholish is not operated by a single attacker group. It is an infrastructure that is sold or rented to various crime groups. This means: multiple simultaneous attacks, a wide variety of targets and industries, availability 24/7 with professional maintenance. **Data and research - the true scope of the threat:** (a) **Proofpoint (2024)** reported that SocGholish was responsible for 30% of all drive-by download attacks in 2023-2024. (b) **ReliaQuest (2024)** identified that SocGholish was the initial vector in 40% of the ransomware attacks they handled. (c) **Mandiant (2025)** mapped over 7,000 domains infected with SocGholish in January 2025 alone. (d) According to the FBI, Evil Corp (the operating group) caused cumulative damage of over $100 million through SocGholish and derived ransomware. (e) The average dwell time of SocGholish in the network before detection: 45 days. **Preferred industries and targets:** SocGholish mainly attacks: (1) business organizations (B2B) - with access to cloud networks and financial systems, (2) software and technology companies - for access to source code and IP, (3) educational and healthcare institutions - large networks with relatively weak security, (4) media and news - sites with high traffic and high trust. **Protection and prevention methods - how to stop SocGholish?** (1) **Employee training - the first front**: educating employees to recognize fake update alerts: browsers update automatically or through the settings - not through pop-ups on websites, never download updates from random websites - only from the browser's official website, do not run .js or .zip files that were downloaded for no clear reason. Phishing exercises that imitate SocGholish - simulations of fake alerts to test awareness. (2) **Web filtering and content security**: EDR (endpoint detection and response) to detect abnormal behavior of JS files, web application firewalls (WAF) to detect malicious code on websites, DNS filtering to block known malicious SocGholish domains. (3) **Application control and script blocking**: blocking the running of Windows Script Host (wscript.exe, cscript.exe) for regular users, AppLocker/WDAC to restrict the running of unsigned files, disabling JavaScript execution in browser settings (extreme - affects functionality). (4) **Network monitoring and threat intelligence**: monitoring outbound traffic to detect Cobalt Strike beacons, using IOCs (indicators of compromise) from CISA, the FBI and security companies, a SIEM for alerts on abnormal activity. (5) **Supply chain security**: periodic security checks of websites and external content providers, subresource integrity (SRI) to verify external JavaScript content, CSP (content security policy) headers to control the JavaScript code that runs on the page. (6) **Incident response plan**: a defined process for handling a suspected SocGholish infection, immediate isolation of infected devices, log review to identify spread. **Case study - a real attack:** in February 2024, a mid-sized financial organization (500 employees) was hit by SocGholish. A senior employee visited an economic news site that had been breached, received a 'Chrome Update' alert, downloaded and ran the file. Within 72 hours the attackers: installed Cobalt Strike on 15 devices in the network, stole 50 GB of financial documents and customer data, and prepared to deploy ransomware. Luckily, the EDR detected abnormal activity in time and the incident was stopped before encryption. The cost of the incident: $850,000 (response, investigation, security improvement). **Summary: SocGholish - a threat that requires an immediate response:** SocGholish is a perfect example of a modern threat: sophisticated, elusive and effective. It exploits our trust in familiar systems, uses legitimate websites as a weapon, and leads to devastating attacks. Protection requires a combination of technology (EDR, filtering, monitoring), continuous employee training, and awareness of the threat. Organizations that do not prepare for SocGholish risk an expensive and paralyzing breach. PhishingU recommends: (1) dedicated training on recognizing fake updates, (2) SocGholish simulations as part of the phishing exercises, (3) periodic security checks of the company's websites, (4) IR exercises for quickly handling an infection.
Glossary
Phishing
An attack method based on social engineering in which attackers impersonate a trusted party in order to steal sensitive information
Spear Phishing
A targeted phishing attack tailored to a specific person or organization
Whaling
A phishing attack aimed at senior executives in the organization
Smishing
Phishing through SMS messages
Vishing
Phishing through voice phone calls
Social engineering
Psychological manipulation of people to get them to reveal information or perform actions
BEC
Business email compromise - compromising a business email for financial fraud
Credential Harvesting
Stealing access credentials (username and password) through fake login pages
Clone Phishing
Cloning a legitimate email and replacing links or files with malicious versions
Pharming
Redirecting users to fake websites by changing DNS settings
2FA
Two-factor authentication - an additional layer of security beyond the password
Ransomware
Malware that encrypts files and demands a ransom for their release
Malware
Malware that damages a computer or steals information
Social Engineering
The use of psychological manipulation to bypass security measures
Zero-Day
A security hole that has not yet been fixed and is not publicly known
Red Team
A team that simulates attackers to test the organization's security
Blue Team
The organization's defense and response team
Incident Response
The response and handling process for a security incident
Baseline
A basic phishing campaign to measure employee awareness and behavior
Lateral Movement
Lateral movement within the network after an initial breach
Whaling Simulation
An advanced phishing exercise tailored to senior executives and directors
Directors' liability
The legal and personal liability of directors for information security
AI Phishing
The use of artificial intelligence to create advanced and personalized phishing scams
Deepfake
Fake video or audio content created using AI
Cyber scenarios
Simulated attack scenarios to test organizational readiness
BCP
Business continuity planning
DR
Disaster recovery - a disaster recovery plan
Credential Management
Secure management of access credentials and passwords
Abnormal activity
Behavior or access to systems that does not match the usual pattern
Cyber insurance
Insurance that covers damage resulting from cyber incidents - breaches, ransomware, data leaks and more
Confirmation of carrying out a phishing exercise
A PhishingU completion certificate attesting that the exercise was carried out. Evidence that helps meet part of insurance and standards requirements, and not a confirmation of full compliance
SPF
Sender Policy Framework - an email authentication mechanism that prevents sender address spoofing
DKIM
DomainKeys Identified Mail - a digital signature for emails to verify the origin of the email
DMARC
Domain-based message authentication - a policy for handling emails that failed SPF/DKIM authentication
Incident Response (IR)
A structured process for identifying, containing, eradicating and recovering from security incidents
Table Top Exercise (TTX)
A simulation exercise to test management's response to a cyber incident with no technical execution
Dwell Time
The time an attacker remains in the network from the moment of intrusion until detection - an average of 207 days
Hot Wash
An immediate summary after an exercise or incident to discuss lessons and improvements
Inject
New information or an event injected into an IR/TTX exercise to test the response
SocGholish
A sophisticated malware framework impersonating browser updates and used to deploy ransomware and steal information
FakeUpdates
Another name for SocGholish - attacks that display fake software updates
Drive-by Download
Automatic download and installation of malicious software from a website without the user's knowledge
Watering Hole Attack
Breaching legitimate websites that the target visits regularly in order to infect it
Cobalt Strike
A legitimate penetration testing tool used by attackers for post-exploitation and remote control
Malware-as-a-Service
A business model in which malware and attack infrastructure are offered as a service to crime groups
Evil Corp
A sophisticated Russian crime group responsible for distributing SocGholish and ransomware such as WastedLocker
IOC
Indicators of compromise - signs that indicate a breach or the presence of malware
JavaScript Obfuscation
Obfuscating JavaScript code to hide its true purpose and bypass antivirus
OSINT
Open source intelligence - collecting information from public sources for research or attack purposes
A phishing check and how to recognize a phishing message
Want a practical phishing check? Start with A free phishing check for your domain, and if you are looking for how to recognize a phishing message in an organization, phishing test for businesses tests employees in a controlled scenario.
* One allowlisting action by your IT team is required, and launch is subject to a security review of up to one business day.