Spear-Phishing, targeted phishing, attacks are on the rise.  The increase in these attacks is in many ways being linked to the increased use of mobile devices for online banking, browsing and email.

Many of the attacks are taking aim at employees with administrative access to their business networks from their mobile devices.  Criminals are using social media sites such as LinkedIn, Sales Spider and Corporation Wiki to determine key personnel.

But it’s not just high level employees who are being targeted; these attackers are getting more sophisticated and mining data from social media sites and blogs to make their emails appear legitimate.  The more personal or relevant the information the email has about you, the more likely you are to believe it’s a genuine email.  Then when you click on link you are taken to spoofed sites containing malware or to provide the username and password information that will allow hackers into your bank or credit card accounts.

In a June 25, 2013 release the FBI says they have noted spear-phishing attacks targeting multiple industries. Per the IC3, “…cyber-criminals target victims because of their involvement in an industry or organization they wish to compromise.  Recent attacks have convinced victims that software or credentials they use to access specific websites needs to be updated.  The email contains a link for completing the update.”

Once clicking the link, the victim is whisked away to a spoofed website and their information is now compromised.  The best rule to use is that banking institutions or credit card providers will never asked you to provide usernames or passwords via email.  You should doubt the legitimacy of any email requesting that kind of information, and unless you are awaiting an email with a link to activate any kind of new online account do not click on the link in the email and instead contact the institution directly to confirm the legitimacy of the request.

[whohit]SpearPhising[/whohit]