Looks like those crafty spammers are up to something new, this
time with the specific purpose of corporate espionage. Now that’s personal.
Dubbed as spear phishing, fraudsters easily spoof the “from”
address of an email, fooling business executives into replying to seemingly
innocent requests for information from people they trust.
“Spear phishing is targeted to particular individuals, pretending
to be another individual who might have approved access,” said Alyn Hockey,
director of global email security firm Clearswift. “If you work for a bank and I knew you are in
a particular role, I could send you an email message pretending to be someone
you know in your company. You would
innocuously think it was a genuine message and reply to it—but it would
actually come to me instead, not the person you think it’s going to.”
Spear phishing attacks carry the potential to commit business
fraud, steal identities, embezzle intellectual property and extract funds all
while damaging corporate branding and wearing down customer trust.
According to IBM these malicious attacks are a growing trend. While not yet widespread, spear phishing
incidents have increased ten-fold since the beginning of the year. In June alone IBM detected around 600,000
attacks.
Industry analysts suggest that spear phishing is not enough of a
problem to deter people from using email, but warn people to think twice before
responding to an email requesting important financial information or passwords.
So be aware. Always ask
yourself whether the email you are about to respond to makes sense and why the
person wants or needs such information.
If alarm bells go off, take two minutes and give the person a quick
phone call.