# data[].attributes.attachment_link.title
What is phishing? Examples, types, and techniques

# data[].attributes.attachment_link.description
Phishing is a type of cyberattack that uses disguised email to trick the recipient into giving up information, downloading malware, or taking some other desired action.

# data[].attributes.attachment_link.title
RBC Cyber Security -  Powerful Passwords

# data[].attributes.attachment_link.readable_text
A cyberattack is a malicious and deliberate attempt by an individual or organization to breach the information system of another individual or organization. Usually, the attacker seeks some type of benefit from disrupting the victim's network.

# data[].attributes.attachment_link.title
What Is a Cyberattack? - Most Common Types

# data[].attributes.attachment_link.description
What is a cyberattack? Learn about common types of cyberattacks and the security threat they pose to your business, and find out how to prevent cybercrime.

# data[].attributes.headline
Cyberattack: Types of Cyberattacks and how to prevent them

# data[].attributes.subject
Cyberattack: Types of Cyberattacks and how to prevent them

# data[].attributes.attachment_link.title
10 Common Types of Cyberattacks and How to Prevent Them

# data[].attributes.attachment_link.description
Learn about the various types of cyberattacks organizations face today and how you can guard against them to keep yourself, your information, and your business safer.

# data[].attributes.attachment_link.readable_text
By

What is a cyber attack?

A cyber attack is any attempt to gain unauthorized access to a computer, computing system or computer network with the intent to cause damage. Cyber attacks aim to disable, disrupt, destroy or control computer systems or to alter, block, delete, manipulate or steal the data held within these systems.

A cyber attack can be launched from anywhere by any individual or group using one or more various attack strategies.

People who carry out cyber attacks are generally regarded as cybercriminals. Often referred to as bad actors, threat actors and hackers, they include individuals who act alone, drawing on their computer skills to design and execute malicious attacks. They can also belong to a criminal syndicate, working with other threat actors to find weaknesses or problems in the computer systems -- called vulnerabilities -- that can be exploited for criminal gain.

Government-sponsored groups of computer experts also launch cyber attacks. They're identified as nation-state attackers, and they have been accused of attacking the information technology (IT) infrastructure of other governments, as well as nongovernment entities, such as businesses, nonprofits and utilities.

Why do cyber attacks happen?

Cyber attacks are designed to cause damage. They can have various objectives, including the following:

Financial gain. Most cyber attacks today, especially those against commercial entities, are launched by cybercriminals for financial gain. These attacks often aim to steal sensitive data, such as customer credit card numbers or employee personal information, which the cybercriminals then use to access money or goods using the victims' identities.

Other financially motivated attacks are designed to disable the computer systems themselves, with cybercriminals locking computers so that their owners and authorized users cannot access the applications or data they need; attackers then demand that the targeted organizations pay them ransoms to unlock the computer systems.

Still other attacks aim to gain valuable corporate data, such as propriety information; these types of cyber attacks are a modern, computerized form of corporate espionage.

Disruption and revenge. Bad actors also launch attacks specifically to sow chaos, confusion, discontent, frustration or mistrust. They could be taking such action as a way to get revenge for acts taken against them. They could be aiming to publicly embarrass the attacked entities or to damage the organizations' reputation. These attacks are often directed at government entities but can also hit commercial entities or nonprofit organizations.

Nation-state attackers are behind some of these types of attacks. Others, called hacktivists, might launch these types of attacks as a form of protest against the targeted entity; a secretive decentralized group of internationalist activists known as Anonymous is the most well known of such groups.

Insider threats are attacks that come from employees with malicious intent.

Cyberwarfare. Governments around the world are also involved in cyber attacks, with many national governments acknowledging or suspected of designing and executing attacks against other countries as part of ongoing political, economic and social disputes. These types of attacks are classified as cyberwarfare.

How do cyber attacks work?

Threat actors use various techniques to launch cyber attacks, depending in large part on whether they're attacking a targeted or an untargeted entity.

In an untargeted attack, where the bad actors are trying to break into as many devices or systems as possible, they generally look for vulnerabilities that will enable them to gain access without being detected or blocked. They might use, for example, a phishing attack, emailing large numbers of people with socially engineered messages crafted to entice recipients to click a link that will download malicious code.

In a targeted attack, the threat actors are going after a specific organization, and methods used vary depending on the attack's objectives. The hacktivist group Anonymous, for example, was suspected in a 2020 distributed denial-of-service (DDoS) attack on the Minneapolis Police Department website after a Black man died while being arrested by Minneapolis officers. Hackers also use spear-phishing campaigns in a targeted attack, crafting emails to specific individuals who, if they click included links, would download malicious software designed to subvert the organization's technology or the sensitive data it holds.

Cyber criminals often create the software tools to use in their attacks, and they frequently share those on the so-called dark web.

Cyber attacks often happen in stages, starting with hackers surveying or scanning for vulnerabilities or access points, initiating the initial compromise and then executing the full attack -- whether it's stealing valuable data, disabling the computer systems or both.

What are the most common types of cyber attacks?

Cyber attacks most commonly involve the following:

1. Malware, in which malicious software is used to attack information systems. Ransomware, spyware and Trojans are examples of malware. Depending on the type of malicious code, malware could be used by hackers to steal or secretly copy sensitive data, block access to files, disrupt system operations or make systems inoperable.

2. Phishing, in which hackers socially engineer email messages to entice recipients to open them. The recipients are tricked into downloading the malware contained within the email by either opening an attached file or embedded link.

3. Man-in-the-middle, or MitM, where attackers secretly insert themselves between two parties, such as individual computer users and their financial institution. Depending on the details of the actual attack, this type of attack may be more specifically classified as a man-in-the-browser attack, monster-in-the-middle attack or machine-in-the-middle attack. It is also sometimes called an eavesdropping attack.

4. DDoS, in which hackers bombard an organization's servers with large volumes of simultaneous data requests, thereby making the servers unable to handle any legitimate requests.

5. SQL injection, where hackers insert malicious code into servers using the Structured Query Language programming language to get the server to reveal sensitive data.

6. Zero-day exploit, which happens when a newly identified vulnerability in IT infrastructure is first exploited by hackers.

7. Domain name system (DNS) tunneling, a sophisticated attack in which attackers establish and then use persistently available access -- or a tunnel -- into their targets' systems.

8. Drive-by, or drive-by download, occurs when an individual visits a website that, in turn, infects the unsuspecting individual's computer with malware.

9. Credential-based attacks happen when hackers steal the credentials that IT workers use to access and manage systems and then use that information to illegally access computers to steal sensitive data or otherwise disrupt an organization and its operations.

How can you prevent a cyber attack?

There is no guaranteed way for any organization to prevent a cyber attack, but there are numerous cybersecurity best practices that organizations can follow to reduce the risk.

Reducing the risk of a cyber attack relies on using a combination of skilled security professionals, processes and technology.

Reducing risk also involves three broad categories of defensive action:

1. preventing attempted attacks from actually entering the organization's IT systems;

2. detecting intrusions; and

3. disrupting attacks already in motion -- ideally, at the earliest possible time.

Best practices include the following:

implementing perimeter defenses, such as firewalls, to help block attack attempts and to block access to known malicious domains;

using software to protect against malware, namely antivirus software, thereby adding another layer of protection against cyber attacks;

having a patch management program to address known software vulnerabilities that could be exploited by hackers;

setting appropriate security configurations, password policies and user access controls;

maintaining a monitoring and detection program to identify and alert to suspicious activity;

creating incident response plans to guide reaction to a breach; and

training and educating individual users about attack scenarios and how they as individuals have a role to play in protecting the organization.

What are the most well-known cyber attacks?

The massive so-called SolarWinds attack, detected in December 2020, breached U.S. federal agencies, infrastructure and private corporations in what is believed to be among the worst cyberespionage attacks inflicted on the U.S. On Dec. 13, 2020, it was revealed that Austin-based IT management software company SolarWinds was hit by a supply chain attack that compromised updates for its Orion software platform. As part of this attack, threat actors inserted their own malware, now known as Sunburst or Solorigate, into the updates, which were distributed to many SolarWinds customers. The first confirmed victim of this backdoor was cybersecurity firm FireEye, which had disclosed on Dec. 8 that it had been breached by suspected nation-state hackers. It was soon revealed that SolarWinds attacks affected other organizations, including tech giants Micrososft and VMware and many U.S. government agencies. Investigations showed that the hackers -- believed to be sponsored by the Russian government -- had been infiltrating targeted systems undetected since March 2020. As of January 2021, investigators were still trying to determine the scope of the attack.

Here is a rundown of some of the most notorious breaches, dating back to 2009:

a July 2020 attack on Twitter, in which hackers were able to access the Twitter accounts of high-profile users;

a breach at Marriott's Starwood hotels, announced in November 2018, with the personal data of upward of 500 million guests compromised;

the Feb. 2018 breach at Under Armour's MyFitnessPal (Under Armour has since sold MyFitnessPal) that exposed email addresses and login information for 150 million user accounts;

the May 2017 WannaCry ransomware attack, which hit more than 300,000 computers across various industries in 150 nations, causing billions of dollars of damage;

the September 2017 Equifax breach, which saw the personal information of 145 million individuals compromised;

the Petya attacks in 2016 that were followed by the NotPetya attacks of 2017, which hit targets around the world causing more than $10 billion in damage;

another 2016 attack, this time at FriendFinder, which said more than 20 years' worth of data belonging to 412 million users was compromised;

a data breach at Yahoo in 2016 that exposed personal information contained within 500 million user accounts, which was then followed by news of another attack that compromised 1 billion user accounts;

a 2014 attack against entertainment company Sony, which compromised both personal data and corporate intellectual property (IP), including yet-to-be-released films, with U.S. officials blaming North Korea for the hack;

eBay's May 2014 announcement that hackers used employee credentials to collect personal information on its 145 million users;

the 2013 breach suffered by Target Corp., in which the data belonging to 110 million customers was stolen; and

the Heartland Payment Systems data breach, announced in January 2009, in which information on 134 million credit cards was exposed.

Cyber attack trends

The number of cyber attacks grew significantly in 2020, following a years-long trend of escalating cyber incidents and presaging a cybersecurity future beset with challenges.

The types of cyber attacks, as well as their sophistication, also grew during the first two decades of the 21st century.

Consider, for example, the growing number and type of attack vectors -- that is, the method or pathway that malicious code uses to infect systems -- over the years.

The first virus was invented in 1986, although it wasn't intended to corrupt data in the infected systems. The first worm distributed through the internet, called the Morris worm, was created in 1988 by Cornell University graduate student Robert Tappan Morris.

Then came Trojan horse, ransomware and DDoS attacks, which became more destructive and notorious with names like WannaCry, Petya and NotPetya -- all ransomware attack vectors.

The 2010s then saw the emergence of cryptomining malware -- also called cryptocurrency mining malware or cryptojacking -- where hackers use malware to illegally take over a computer's processing power to use it to solve complex mathematical problems in order to earn cryptocurrency, a process called mining. Cryptomining malware dramatically slows down computers and disrupts their normal operations.

Hackers also adopted more sophisticated technologies throughout the first decades of the 21st century, using machine learning and artificial intelligence (AI), as well as bots and other robotic tools, to increase the velocity and volume of their attacks.

And they developed more sophisticated phishing and spear-phishing campaigns, even as they continued to go after unpatched vulnerabilities; compromised credentials, including passwords; and misconfigurations to gain unauthorized access to computer systems.

Continue Reading About cyber attack

# data[].attributes.attachment_link.title
What is a Cyber Attack? Definition, Types and Examples

# data[].attributes.attachment_link.description
A cyber attack is any attempt to gain unauthorized access to a computing system or network with the intent to cause damage. This in-depth definition of cyber attack covers the common types of cyber attacks, how they work, how to prevent them and where they're trending.

# data[].attributes.attachment_link.title
10 ways a cyber attack can hurt your business

# data[].attributes.attachment_link.description
Cyber attacks are an ever-present invisible threat that can seriously damage your business. Learn about 10 threats you might be missing.

# data[].attributes.attachment_link.readable_text
Contents

What is a cyber attack?

A cyber attack is an attempt to disable computers, steal data, or use a breached computer system to launch additional attacks. Cybercriminals use different methods to launch cyber attacks including malware, phishing

Cybercriminals use different methods to launch cyber attacks including malware, phishing, denial of service attacks, and ransomware.

What you can do to protect yourself

Here are some steps you can take to protect yourself from cyber attacks.

Be on the lookout for suspicious links, attachments, and downloads
Malware and ransomware can be embedded in links, attachments, and downloads. Make sure a link is authentic before clicking on it.

Create and use strong passwords
You should always use strong and long passwords that are difficult to hack. Use unique passwords, meaning a different one for each account. Passwords should be at least 8 characters in length and contain numbers, special characters, and capitalized letters.

Use multi-factor authentication whenever possible
Multi-factor authentication adds an extra layer of security. If a service you are using offers multi-factor authentication, use it.

Use secure internet communications
Use sites that use "HTTPS" if you will access or provide any personal information. Don't use sites with invalid certificates.

Update your anti-virus software regularly
Make sure your anti-virus software is up to date and updates are installed regularly.

Report anything suspicious to your IT department
Report any suspicious emails, files, or links to your company's IT department.

Additional resources from CISA.Gov

Threats
Protecting Against Ransomware Protecting Against Malicious Code Handling Destructive Malware Understanding Denial-of-Service Attacks Avoiding Social Engineering and Phishing Attacks Preventing and Responding to Identity Theft
Email and Communication
Staying Safe on Social Networking Sites Using Caution with Email Attachments Reducing Spam
General Security Information
Securing Network Infrastructure Devices Securing the Internet of Things Home Network Security Keeping Children Safe Online Understanding Firewalls for Home and Small Office Use Good Security Habits
Mobile Devices
Privacy and Mobile Device Apps Holiday Traveling with Personal Internet-Enabled Devices Cybersecurity for Electronic Devices Using Caution with USB Drives Securing Wireless Networks
Passwords
Supplementing Passwords Choosing and Protecting Passwords
Safe Browsing
Shopping Safely Online Understanding Bluetooth Technology Understanding Website Certificates
Software and Applications
Understanding Patches and Software Updates

# data[].attributes.attachment_link.description
Information and resources from the Washington Department of Financial Institutions.

# data[].attributes.headline
How does Identity Theft affect business?

# data[].attributes.subject
How does Identity Theft affect business?

# data[].attributes.headline
Six ways to protect yourself against cyberattacks

# data[].attributes.subject
Six ways to protect yourself against cyberattacks

# data[].attributes.attachment_link.title
Six Ways to Protect Yourself Against Cyber Attacks

# data[].attributes.attachment_link.description
Learn what you can do to safeguard your money and personal information from criminals.

# data[].attributes.headline
6 major impacts of Cybercrime on business

# data[].attributes.subject
6 major impacts of Cybercrime on business

# data[].attributes.attachment_link.title
The Consequences of Cyber Attacks and Their Impact on Cybersecurity - CEI

# data[].attributes.attachment_link.description
As our reliance on technology and connectivity grows, so does our vulnerability to cyberattacks. Unlike the viruses of a few years ago that would shut

# data[].attributes.attachment_link.title
Cyber attack: definition, consequences + types

# data[].attributes.attachment_link.description
What are cyber attacks + why are they carried out? All information on possible consequences for companies & types of cyber attacks here ➡️

# data[].attributes.attachment_link.description
Pretexting is use of a fabricated story, or pretext, to gain a victim’s trust and trick or manipulate them into otherwise harming themselves or their organization.

# data[].attributes.attachment_link.title
What Is Pharming? - Definition, Examples & More | Proofpoint US

# data[].attributes.attachment_link.description
A pharming attack involves sending users to fake websites to trick them into divulging private information. Learn the definition of pharming, how it works, and more.

# data[].attributes.attachment_link.title
What Is Pharming and How To Protect Against Attacks | Fortinet

# data[].attributes.attachment_link.description
Pharming is a type of online fraud that directs victims to spoofed websites in an attempt to steal their credentials and data. Discover what is pharming, the types of pharming attacks, and how to protect your organizations from pharming.

# data[].attributes.attachment_link.title
Pharming - What is it and how to prevent it? | Malwarebytes

# data[].attributes.attachment_link.description
What is pharming and how can you prevent it? Learn how cybercriminals use pharming to redirect your browser from real websites to fake ones without you knowing.

# data[].attributes.attachment_link.readable_text
What is phishing? Phishing definition

Phishing is the crime of deceiving people into sharing sensitive information like passwords and credit card numbers. As with real fishing, there's more than one way to reel in a victim, but one phishing tactic is the most common. Victims receive a malicious email ( malspam) or a text message that imitates (or " spoofs ") a person or organization they trust, like a coworker, a bank, or a government office. When the victim opens the email or text, they find a scary message meant to overcome their better judgement by filling them with fear. The message demands that the victim go to a website and take immediate action or risk some sort of consequence.

If users take the bait and click the link, they're sent to an imitation of a legitimate website. From here, they're asked to log in with their username and password credentials. If they are gullible enough to comply, the sign-on information goes to the attacker, who uses it to steal identities, pilfer bank accounts, and sell personal information on the black market.

"Phishing is the simplest kind of cyberattack and, at the same time, the most dangerous and effective."

Unlike other kinds of online threats, phishing does not require particularly sophisticated technical expertise. In fact, according to Adam Kujawa, Director of Malwarebytes Labs, "Phishing is the simplest kind of cyberattack and, at the same time, the most dangerous and effective. That is because it attacks the most vulnerable and powerful computer on the planet: the human mind." Phishers are not trying to exploit a technical vulnerability in your device's operation system-they're using social engineering. From Windows and iPhones, to Macs and Androids, no operating system is completely safe from phishing, no matter how strong its security is. In fact, attackers often resort to phishing because they can't find any technical vulnerabilities. Why waste time cracking through layers of security when you can trick someone into handing you the key? More often than not, the weakest link in a security system isn't a glitch buried in computer code, it's a human being who doesn't double check where an email came from.

The latest phishing news

History of phishing

The origin of the name "phishing" is easy enough to trace. The process of performing a phishing scam is much like actual, aquatic fishing. You assemble some bait designed to deceive your victim, then you cast it out and hope for a bite. As for the digraph "ph" replacing the "f," it could be the result of a portmanteau of "fishing" and "phony," but some sources point back to another possible origin.

In the 1970s, a subculture formed around the practice of using low-tech hacks to exploit the telephone system. These early hackers were called "phreaks"-a combination of "phone" and "freaks." At a time when there weren't many networked computers to hack, phreaking was a common way to make free long-distance calls or reach unlisted numbers.

Even before the actual phishing term took hold, a phishing technique was described in detail in a paper and presentation delivered to the 1987 International HP Users Group, Interex.

The use of the name itself is first attributed to a notorious spammer and hacker in the mid-1990s, Khan C Smith. Also, according to Internet records, the first time that phishing was publicly used and recorded was on January 2, 1996. The mention occurred in a Usenet newsgroup called AOHell. At the time, America Online (AOL) was the number one provider of Internet access, with millions of log-ons daily.

Naturally, AOL's popularity made it a target for fraudsters. Hackers and software pirates used it to communicate with one another, as well as to conduct phishing attacks on legitimate users. When AOL took steps to shut down AOHell, the attackers turned to other techniques. They sent messages to AOL users claiming to be AOL employees and asked people to verify their accounts and hand over billing information. Eventually, the problem grew so bad that AOL added warnings on all email and instant messenger clients stating "no one working at AOL will ask for your password or billing information."

"Social networking sites became a prime phishing target."

Going into the 2000s, phishing turned its attention to exploiting online payment systems. It became common for phishers to target bank and online payment service customers, some of whom-according to subsequent research-might have even been accurately identified and matched to the actual bank they used. Likewise, social networking sites became a prime phishing target, attractive to fraudsters since personal details on such sites are useful for identity theft.

Criminals registered dozens of domains that spoofed eBay and PayPal well enough that they passed for the real thing if you weren't paying close enough attention. PayPal customers then received phishing emails (containing links to the fake website), asking them to update their credit card numbers and other personally identifiable information. The first known phishing attack against a bank was reported by The Banker (a publication owned by The Financial Times Ltd.) in September 2003.

By the mid-2000s, turnkey phishing software was readily available on the black market. At the same time, groups of hackers began to organize in order to orchestrate sophisticated phishing campaigns. Estimated losses due to successful phishing during this time vary, with a 2007 report from Gartner stating that as many as 3.6 million adults lost $3.2 billion between August 2006 and August 2007.

"In 2013, 110 million customer and credit card records were stolen from Target customers."

In 2011, phishing found state sponsors when a suspected Chinese phishing campaign targeted Gmail accounts of highly ranked officials of the United States and South Korean governments and militaries, as well as Chinese political activists.

In perhaps the most famous event, in 2013, 110 million customer and credit card records were stolen from Target customers, through a phished subcontractor account.

Even more infamous was the phishing campaign launched by Fancy Bear (a cyber espionage group associated with the Russian military intelligence agency GRU) against email addresses associated with the Democratic National Committee in the first quarter of 2016. In particular, Hillary Clinton's campaign manager for the 2016 presidential election, John Podesta, had his Gmail hacked and subsequently leaked after falling for the oldest trick in the book-a phishing attack claiming that his email password had been compromised (so click here to change it).

In 2017, a massive phishing scam tricked Google and Facebook accounting departments into wiring money, a total of over $100 million, to overseas bank accounts under the control of a hacker.

Types of phishing attacks

Despite their many varieties, the common denominator of all phishing attacks is their use of a fraudulent pretense to acquire valuables. Some major categories include:

Spear phishing

While most phishing campaigns send mass emails to as many people as possible, spear phishing is targeted. Spear phishing attacks a specific person or organization, often with content that is tailor made for the victim or victims. It requires pre-attack reconnaissance to uncover names, job titles, email addresses, and the like. The hackers scour the Internet to match up this information with other researched knowledge about the target's colleagues, along with the names and professional relationships of key employees in their organizations. With this, the phisher crafts a believable email.

For instance, a fraudster might spear phish an employee whose responsibilities include the ability to authorize payments. The email purports to be from an executive in the organization, commanding the employee to send a substantial payment either to the exec or to a company vendor (when in fact, the malicious payment link sends it to the attacker).

Spear phishing is a critical threat to businesses ( and governments), and it costs plenty. According to a 2016 report of a survey on the subject, spear phishing was responsible for 38% of cyberattacks on participating enterprises during 2015. Plus, for the U.S. businesses involved, the average cost of spear phishing attacks per incident was $1.8 million.

"A verbose phishing email from someone claiming to be a Nigerian prince is one of the Internet's earliest and longest-running scams."

Clone phishing

In this attack, criminals make a copy-or clone-of previously delivered but legitimate emails that contain either a link or an attachment. Then, the phisher replaces the links or attached files with malicious substitutions disguised as the real thing. Unsuspecting users either click the link or open the attachment, which often allows their systems to be commandeered. Then the phisher can counterfeit the victim's identity in order to masquerade as a trusted sender to other victims in the same organization.

419/Nigerian scams

A verbose phishing email from someone claiming to be a Nigerian prince is one of the Internet's earliest and longest-running scams. According to Wendy Zamora, Head of Content at Malwarebytes Labs, "The Nigerian prince phish comes from a person claiming to be a government official or member of a royal family who needs help transferring millions of dollars out of Nigeria. The email is marked as 'urgent' or 'private,' and its sender asks the recipient to provide a bank account number for safekeeping the funds."

In a hilarious update of the classic Nigerian phishing template, British news website Anorak reported in 2016 that it received an email from a certain Dr. Bakare Tunde, who claimed to be the project manager of astronautics for Nigeria's National Space Research and Development Agency. Dr. Tunde alleged that his cousin, Air Force Major Abacha Tunde, had been stranded on an old Soviet space station for more than 25 years. But for only $3 million, Russian space authorities could mount a flight to bring him home. All the recipients had to do was send in their bank account information in order to transfer the needed amount, for which Dr. Tunde will pay a $600,000 fee.

Incidentally, the number " 419" is associated with this scam. It refers to the section of the Nigerian Criminal Code dealing with fraud, the charges, and penalties for offenders.

Phone phishing

With phone-based phishing attempts, sometimes called voice phishing or " vishing," the phisher calls claiming to represent your local bank, the police, or even the IRS. Next, they scare you with some sort of problem and insist you clear it up immediately by sharing your account information or paying a fine. They usually ask that you pay with a wire transfer or with prepaid cards, so they are impossible to track.

SMS phishing, or " smishing," is vishing's evil twin, carrying out the same kind of scam (sometimes with an embedded malicious link to click) by means of SMS texting.

"The email makes an offer that sounds too good to be true."

How to identify a phishing attack

Recognizing a phishing attempt isn't always easy, but a few tips, a little discipline, and some common sense will go a long way. Look for something that's off or unusual. Ask yourself if the message passes the "smell test." Trust your intuition, but don't let yourself get swept up by fear. Phishing attacks often use fear to cloud your judgement.

Here are a few more signs of a phishing attempt:

The email makes an offer that sounds too good to be true. It might say you've won the lottery, an expensive prize, or some other over-the-top item.

You recognize the sender, but it's someone you don't talk to. Even if the sender's name is known to you, be suspicious if it's someone you don't normally communicate with, especially if the email's content has nothing to do with your normal job responsibilities. Same goes if you're cc'd in an email to folks you don't even know, or perhaps a group of colleagues from unrelated business units.

The message sounds scary. Beware if the email has charged or alarmist language to create a sense of urgency, exhorting you to click and "act now" before your account is terminated. Remember, responsible organizations do not ask for personal details over the Internet.

The message contains unexpected or unusual attachments. These attachments may contain malware, ransomware, or another online threat.

The message contains links that look a little off. Even if your spider sense is not tingling about any of the above, don't take any embedded hyperlinks at face value. Instead, hover your cursor over the link to see the actual URL. Be especially on the lookout for subtle misspellings in an otherwise familiar-looking website, because it indicates fakery. It's always better to directly type in the URL yourself rather than clicking on the embedded link.

Here's an example of a phishing attempt that spoofs a notice from PayPal, asking the recipient to click on the "Confirm Now" button. Mousing over the button reveals the true URL destination in the red rectangle.

Here's another phishing attack image, this time claiming to be from Amazon. Note the threat to close the account if there's no response within 48 hours.

Clicking on the link leads you to this form, inviting you to give away what the phisher needs to plunder your valuables:

How do I protect myself against phishing?

As stated previously, phishing is an equal opportunity threat, capable of showing up on desktops, laptops, tablets, and smartphones. Most Internet browsers have ways to check if a link is safe, but the first line of defense against phishing is your judgement. Train yourself to recognize the signs of phishing and try to practice safe computing whenever you check your email, read Facebook posts, or play your favorite online game.

Once again from our own Adam Kujawa, here are a few of the most important practices to keep you safe:

Don't open e-mails from senders you are not familiar with.

Don't ever click on a link inside of an e-mail unless you know exactly where it is going.

To layer that protection, if you get an e-mail from a source you are unsure of, navigate to the provided link manually by entering the legitimate website address into your browser.

Lookout for the digital certificate of a website.

If you are asked to provide sensitive information, check that the URL of the page starts with "HTTPS" instead of just "HTTP." The "S" stands for "secure."It's not a guarantee that a site is legitimate, but most legitimate sites use HTTPS because it's more secure. HTTP sites, even legitimate ones, are vulnerable to hackers.

If you suspect an e-mail isn't legitimate, take a name or some text from the message and put it into a search engine to see if any known phishing attacks exist using the same methods.

Mouseover the link to see if it's a legitimate link.

As always, we recommend using some sort of anti-malware security software. Most cybersecurity tools have the ability to detect when a link or an attachment isn't what it seems, so even if you fall for a clever phishing attempt, you won't end up sharing your info with the wrong people.

All Malwarebytes premium security products provide robust protection against phishing. They can detect fraudulent sites and stop you from opening them, even if you're convinced they're legitimate. You can even try Malwarebytes free before you buy.

So stay vigilant, take precautions, and look out for anything phishy.

How does phishing affect my business?

The fact of the matter is this-cybercriminals are targeting your business. As reported in the Malwarebytes Labs Cybercrime Tactics and Techniques Report (CTNT), attacks on businesses went up 55 percent in the second half of 2018 with Trojans and ransomware proving to be the most popular types of attacks. Specifically, Trojan attacks on businesses rose 84 percent while ransomware attacks went up 88 percent. Phishing often plays an important role in Trojan and ransomware attacks, because cybercriminals rely on phishing emails to get victims to download the malware and initiate the attack.

The Emotet banking Trojan, for instance, that wreaked havoc throughout 2018 includes a spam module that scans contact lists on an infected computer and sends your friends, family, and coworkers phishing emails that link to a malware laden attachment or download. In an interesting twist, Emotet, once a banking Trojan in its own right, is now being used to deliver other malware, including ransomware.

What happens once malware like Emotet gets a foothold on your network via a phishing attack? Just ask the beleaguered city officials of Allentown. The 2018 attack on the Pennsylvania city required direct help from Microsoft's incident response team to clean up and reportedly cost the city upwards of one million dollars to fix.

See all our reporting on phishing at Malwarebytes Labs.

# data[].attributes.attachment_link.title
What is phishing? How to protect against phishing attacks | Malwarebytes

# data[].attributes.attachment_link.description
Phishing is the crime of deceiving people into sharing sensitive information like passwords and credit card numbers. As with real fishing, there's more than one way to reel in a victim, but one phishing tactic is the most common.

# data[].attributes.attachment_link.title
Ministerio Público Fiscal de la Provincia del Chubut - Fiscalia Cibercrimen

# data[].attributes.attachment_link.description
Ministerio Público Fiscal de la Provincia del Chubut. Justicia Penal de Chubut.