While malware is certainly still a threat, these days it’s often easier for criminals to target your data instead of just your device. If bad actors can steal your passwords, banking information or other sensitive data, they can gain access to assets like your money or means to blackmail you.
Cue phishing, a social engineering scheme designed to steal your data. Attackers may use texts, emails, voicemails, fake websites or malicious apps to lure you and reel in your personal information. It’s like fishing, where you’re the game, and deceptive messages, apps, websites and pop-ups are the bait. And it’s become a whole lot easier thanks to prepackaged phishing templates.
Cybercriminals want your data more than your device
To avoid a crappy solar panel deal, watch out for these scammy sales tactics.
Getty Images/Tharon Green/CNETPhishing is where cybercriminals pretend to be someone you’re willing to trust, like your bank, your employer, a delivery company or even a friend or family member. The bait can arrive through email, a text message, a fake website, a QR code or a phone call. Click the wrong link or hand over the wrong information, and you could end up dealing with stolen accounts, fraudulent purchases or identity theft.
More from CNET
Phishing itself isn’t new, but the way criminals carry it out has changed. A growing criminal business model called phishing-as-a-service, often shortened to PhaaS, makes it much easier for scammers to launch convincing phishing campaigns.
Phishing-as-a-service is making things easier for scammers and harder for you
Phishing-as-a-service applies a familiar business model to cybercrime. Instead of building phishing scams from scratch, bad actors can pay for ready-made tools that let them launch convincing attacks with far less technical knowledge.
It will differ based on who the malicious actors make a deal with, but a typical phishing kit may include:
- Fake login pages that imitate trusted websites
- Email templates designed to look legitimate
- Website hosting for phishing pages
- Lists of potential targets
- Setup guides and instructions
- Customer support, which some providers may even offer
The result is that people with little technical experience can run phishing campaigns that once required far more know-how. Researchers have found that this lower barrier to entry is helping less-experienced cybercriminals launch increasingly sophisticated attacks.
“The biggest change with phishing-as-a-service is the scale,” said Christopher Michaelis, founder and CTO of Strategic Code, who has more than two decades of experience building secure software systems. “It’s far more likely that an ordinary person becomes the target. People sometimes assume these attacks are only aimed at CEOs or government officials, when it’s really the opposite. Industrial-scale phishing means almost anyone can end up in the crosshairs.”
Why phishing-as-a-service is increasing your risk
Angela Lang/CNETThe biggest risk from phishing-as-a-service isn’t necessarily that every scam is more convincing. It’s that there are far more of them. When you make phishing cheap and easy to launch, more people do it. Instead of a handful of technically skilled criminals running campaigns, you now have a much larger pool of people buying the same tools and sending the same kinds of scams.
Artificial intelligence has also made phishing harder to spot. The old advice about looking for bad grammar and obvious spelling mistakes doesn’t necessarily carry as much weight as it used to. AI can produce polished emails in seconds, so it’s often more useful to question why you’re being asked to click a link, open an attachment or hand over personal information than to judge how well the message is written.
Scammers benefit from phishing-as-a-service, but you can protect yourself
Phishing-as-a-service may be making it easier to launch scams, but the security fundamentals haven’t changed much. Most phishing attacks still depend on getting someone to act before they stop and think. A few good habits won’t eliminate the risk, but they can make you a harder target.
Protect yourself from phishing attempts
When something unexpected lands in your inbox or on your phone, don’t let the message set the pace. Take a minute to look it over before clicking anything.
- Pause before responding to unexpected emails, texts or phone calls.
- Hover over links before clicking and make sure the destination matches what you expect.
- Type important website addresses directly into your browser whenever possible.
- Be wary of urgent requests for money, passwords or verification codes.
- Avoid opening attachments you weren’t expecting.
- Run suspicious links through a reputable scam-checking service.
- Keep your browser, operating system and security software up to date.
Modern browsers and antivirus software can also block many malicious websites and downloads before they have a chance to do any damage. They’re not foolproof, but they work great alongside a healthy dose of skepticism when something doesn’t look or feel right. If you’re seriously concerned you may be targeted, identity theft protection can warn you by monitoring your Social Security number, email address and even searching the dark web for your information.
Make stolen information less valuable
Not every phishing attack starts with you. Sometimes, a company you use falls victim to a phishing attack and is tricked into handing over customer data. That’s one reason it’s worth strengthening your accounts before something goes wrong.
- Use passkeys when you can, which are safer than passwords.
- Turn on multifactor authentication for important accounts so there’s a second line of login defense.
- Use unique passwords stored in a password manager.
- Delete accounts you no longer use.
- Reduce your online footprint by removing information you don’t need to share.
- Keep an eye on your accounts for suspicious activity and breach notifications.
None of these steps makes phishing disappear. They do, however, make it much harder for criminals to turn a stolen password or exposed email address into something more serious.
Your best defenses are good security habits
Phishing kits have changed who can run scams and how many social engineering schemes are out there, but they haven’t changed how you defend yourself. You don’t need to understand how phishing kits work to protect yourself, either. What matters is recognizing that these scams are becoming more common and knowing how to respond when one reaches you – or when you’re actually scammed.
As Michaelis put it, “There’s a phrase in cybersecurity called ‘security through obscurity.’ Nobody is obscure anymore.” That doesn’t mean you’re powerless, though. The best defenses are still the simplest ones. Slow down before you click a link, verify unexpected requests and strengthen your accounts. Phishing isn’t likely going anywhere anytime soon, but you can make yourself a much harder target.
