Another Phishing Scam is Appearing in Small Business Inboxes

Another Phishing Scam is Appearing in Small Business Inboxes

Just last week we wrote about a phishing scam that was making the rounds at small businesses. This email message boasted to recipients that “your email account and device <have> been hacked” and “we have installed one RAT software into your device.”

While this message turned out to be a fake, there’s a real email that you need to watch out for that follows the classic phishing playbook of pretending to be a coworker with an “Urgent Request.”

Let’s look at what to watch out for and the steps you can take to prevent this email from tricking your fellow employees.

The Email

The trick of this phishing scam is in its simplicity. Posing as the president of the company, the email states:

Are you Available? I need you to personally run a task form me ASAP. I am caught up in meetings all day. Just reply my Emails. Let me know if you can get this done right now.

There’s more than one warning flag in this email. From the random capitalization of “Available” and “Emails,” to poor grammar (just reply my Emails), it’s clear something is off. Additionally, the message doesn’t provide any details about the request.

This is a textbook phishing case. While there are immediate red flags, a busy employee might see the email come through and respond without a second thought.

Now, you might be thinking that there’d be no harm if your employee, especially since it’s not like the message itself contains any potentially corrupted links. You’d be wrong.

Just responding to the message gives hackers information about your company’s system. With the employee’s response, they’ll know the email account is active — resulting in more spam and phishing attempts being sent their way. Furthermore, a response will provide the hacker with general server information. This is not end of the world, but it just makes your organization more vulnerable down the road. 

After a response, the hacker will then likely send a malicious link to your employee’s inbox, which, if clicked on, would allow them to enter the system and compromise your organization’s data.

This is why it’s important to train employees in cybersecurity awareness.

How to Prevent

Cybersecurity awareness training is one of the best methods for changing habits of employees and instilling them with skepticism about the emails they’re opening. But your entire system’s security shouldn’t come down to your employees. Software programs can be set up to catch emails just like this. In fact, it’s how we discovered this exact phishing email.

Mimecast’s targeted threat protection caught the phishing attempt before the email made it into the employee’s inbox. Here’s what that email looked like in our system:

Screen Shot 2018-10-15 at 10.19.26 AM

The threat protection recognized that the email sender had the same name as an employee, but the email address didn’t line up. It also noticed that the spoof email address domain is brand new, another hallmark of a phishing attempt.

With email threat protection like this in place and healthy email skepticism from employees, your organization will be in a significantly better position to handle phishing attempts than most.  

Learn more about how to secure your small business with enterprise-level security features like email threat protection here.

Written by Nik Vargas