Credential Phishing - A raising threat
At its core, credential phishing aims to trick end-users. This is usually through direct messaging platforms, and can take various forms: en-masse opportunistic attempts to steal passwords, or highly-targeted and high-pressure emails that masquerade as the victim’s colleagues or bosses.
Since the explosion of generative AI, attackers are able to craft far more grammatically correct phishing messages – and online services allow for the easy creation of near-perfect login pages.
While attackers’ toolkits are greater than ever, companies that rely on remote workers and a large number of digital services are consistently weaker against credential phishing attacks.
This is due to the greater number of potential login pathways for remote employees – and made worse by the fact that remote workers don’t have the ease of popping their head around the desk of a colleague to double-check a message’s veracity.
How Credential Phishing Works
The rough layout of every credential phishing attack is as follows:
- Attacker drafts a message that evades various filters.
- Victim receives the message, reads it, and clicks the malicious link or attachment.
- The link leads to a phishing site, usually a login page, or downloads a keylogger.
- On the phishing site, victims are prompted to type in their login credentials.
- The attacker receives these login credentials, and uses them on the victim’s genuine account.
- Attacker gets access to the genuine online account, gaining a foothold in the organization’s defenses.
The anatomy of a successful attack can be split into three key parts: the login page, the message, and the user’s own context.
The Login Page
A key mechanism to a successful credential harvesting campaign is the landing page.
This is where the user needs to be fully invested in the campaign’s legitimacy, and act as they would on the genuine site. Some attackers increase the page’s legitimacy by including fake captcha screens, alongside stealing the web elements of the genuine page:
- Logos
- Credential input boxes
- Backgrounds
The Message
The malicious message can be equally important, however – if the user receives a highly-urgent request to log on, they’re far more likely to hurry through the login page, and therefore miss indicators of a phishing attack.
Email continues to be one of the most popular vectors of attack, due to the ease with which commercialized PII theft now offers massive databases of commercial email addresses. Attackers may just steal email addresses from LinkedIn accounts, or scrape them from your company’s website.
These emails’ subject lines may mimic a few things:
- A request from HR
- A fake login authentication email from a payment processor
The body of the message will reinforce this while directing the user to a shortened or hidden URL, or even a file to download.
The User’s Context
Vital to understanding your true risk profile is the context of the user themselves: an email purporting to verify a Xero password change would hook far more members of the finance team, whereas DevOps are more likely to fall for GitHub login fraud.
This contextual difference is key to developing strategies to protect the entire organization.
3 Defensive Strategies Against Credential Phishing
The best defenses take a multi-pronged approach of reinforcing behavior with security architecture.
#1: Train and Test Employees Regularly
Since credential phishing takes advantage of end users’ busy schedules and tight deadlines, it’s immensely important to bolster their own personal defenses. While there’s not much you can do about tight deadlines, you can teach employees how to recognize when they’re being exploited.
Phishing Education
Phishing education aims to build a foundational understanding of phishing and raise employee awareness. It needs to explain:
- How credential phishing works
- The tactics used by attackers
- The threat a successful attack represents
The end result is to give employees the general cybersecurity knowledge to recognize potential threats.
Phishing Training
Phishing training, on the other hand, goes beyond basic education and works to develop practical skills.
It should employ interactive modules and simulated phishing campaigns that help train employees on identifying red flags, verifying information, and avoiding phishing scams. Essentially, it involves applying the knowledge gained from education to real-world situations.
#2: Multi-Factor Authentication (MFA)
Multi-factor authentication adds another layer to the authentication process – not only do you need to provide something you know (ie, the password), but you further need to prove you have something (like a phone), and/or you are something (like a human, with a fingerprint).
This extra layer of proof makes it substantially harder to simply take over an account, even if the attacker successfully conducts a phishing attack.
But note that employees that rely on MFA may be vulnerable to attacks that explicitly play off its multi-device aspect. They may be more convinced to click a fraudulent link via text message, and this needs to be adequately reflected in the training they receive.
#3: Behavior Analytics
When an attacker steals user credentials and gains access to an account, every second counts.
Unfortunately, it can prove almost impossible to stop an attack after it reaches this stage. Let’s illuminate the difference that User and Endpoint Behaviour Analytics (UEBA) can make:
User and Endpoint Behavior Analytics
Imagine Jordan, an employee at TechCo: his typical day-to-day work spans the usual 9am-5pm, and he works mainly from his home on the West Coast. During the days he downloads an average of 50 MB, and interacts with a few key cloud applications. With UEBA in place, the TechCo security team can see when, all of a sudden, Jordan’s account logs in at 2am, and begins downloading several gigabytes of data.
While analysts wouldn’t traditionally have been able to spot this kind of information in the sea of log and network data usually going on, the UEBA solution is able to automatically lock down Jordan’s account and alert the analyst.
This way, UEBA can single-handedly identify and prevent an attack – even in the event of corporate credential theft and misuse.
Get Full-Fidelity Phishing Defense With Check Point Harmony
Harmony Endpoint by Check Point is an all-encompassing and unified endpoint security solution designed to protect your workforce from today’s über-complex phishing threats. Its next-gen protection evens the playing field between attackers and security teams, thanks to its ability to identify and isolate endpoint devices that do not comply with their individual behavioral baselines.
Our credential phishing prevention-first approach is why we were named a leader in enterprise email security, as protection extends to the websites that each user is visiting.
Continuous heuristics-based analysis of website requests allows the complete prevention of not just credential phishing, but any other endpoint-focused malware. See how it can keep your organization shielded from attacks while also simplifying security operations with a demo today.
Feedback