Increased “Shipping Delays” Now Served as Phishbait

Attackers are exploiting pandemic-related supply-chain disruptions to launch phishing campaigns, according to Troy Gill, senior manager of threat intelligence at Zix. In an article for Threatpost, Gill describes a phishing attack that impersonated a major shipping company.

“[R]ecently the Zix Threat Research team uncovered a spoofing attack where the threat actors posed as one of the largest container-shipping lines in the world,” Gill says. “The email encouraged the recipient to download a shipping document confirmation by clicking on a malicious link. If the user compiled, they would be directed to a very convincing phishing page that cycled through different realistic-looking company backgrounds, with a sign-in screen overlay meant to steal the user’s email credentials.”

Gill points out that these phishing emails, like many social engineering attacks, instill a sense of urgency to compel users to click the link.

“Another continuing trend involves generating a feeling of pressure and urgency to keep recipients from giving it too much thought before responding or following the link,” Gill writes. “Of late, this tactic has become more convincing and subtle, such as stating individuals will lose access to a valuable account if they do not respond immediately.”

Gill concludes that organizations need to use a combination of employee training and security technologies to defend against phishing attacks.

“Although spoofing attacks are continuing to evolve, the burden on organizations can be lessened by implementing the right training and adopting the most effective technology solutions to keep email, employees and the company as a whole protected,” Gill writes. “Shipping and logistics companies are dealing with a lot of uncertainty right now, and so are their customers. The strength of companies’ cybersecurity posture doesn’t need to be another question mark.”

External stressors like the COVID pandemic can have important implications for the threats a business faces. New-school security awareness training can give your organization an essential layer of defense by enabling your employees to spot phishing attacks.

Threatpost has the story.

---

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

Here’s how it works:

• Immediately start your test for up to 100 users (no need to talk to anyone)
• Select from 20+ languages and customize the phishing test template based on your environment
• Choose the landing page your users see after they click
• Show users which red flags they missed, or a 404 page
• Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
• See how your organization compares to others in your industry

PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW