Pumpkin Spice and Phishing Advice: New Phish Templates!
- CyberSpeak Labs
- Sep 15, 2024
- 2 min read
Phishing remains one of the top threats targeting businesses in 2024. As cyber defenders, educators, and leaders, it's our responsibility to ensure that our organizations are protected to the best of our ability. Even as new threats emerge, particularly in the phishing landscape, our vigilance is key.
As fall ushers in nostalgic traditions like visiting pumpkin patches, sipping pumpkin spice lattes, and other seasonal activities, threat actors are also gearing up. They capitalize on this time of year, using phishing scams and other social engineering tactics tailored to the season.
While we enjoy the spirit of autumn, it's essential to stay aware of emerging phishing threats. Below are some of the latest trends you can promote within your organization to raise awareness. At the end of this blog, you'll find a GitHub link with resources to incorporate these threats into your phishing simulations.
Voter SMS Phishing
News Article: Voter Registration SMS Phish
GitHub Link: SMS_VoterRegistration GitHub A trending smishing campaign is targeting the 2024 United States presidential election. Victims receive a text message claiming that they are not registered to vote, urging them to take immediate action. When they click the provided link, it appears to lead to a legitimate voter registration website, but in reality, it redirects to a malicious site. The goal of the threat actors behind this scam is to steal personal information from the victims. Company Awareness Highlights: Remind employees that all official voter registration forms will come from government-approved sources. If you receive unsolicited text messages regarding voter registration or similar topics, block the sender and avoid any interaction. Official Voting Guidelines
File-Sharing Phishing Emails News Article: Increase of File-Sharing Phishing Campaigns GitHub Link: File-Sharing GitHub A growing trend is that threat actors are increasingly using online file-sharing platforms like Google Drive and Microsoft SharePoint to bypass initial sandbox scanning by email security tools. These attacks often involve multiple stages of user interaction. Users may be prompted to enter company credentials on counterfeit file-sharing sites or inadvertently download malware from legitimate file-sharing platforms, thereby introducing risks to the business. Company Awareness and Highlights: Remind users to submit company credentials only to company-approved and managed platforms. Encourage them to carefully review emails and URLs to confirm that the sender is known or expected, and that any page requesting credentials is from a legitimate Microsoft, Google, or similarly recognized site. Additionally, advise users to avoid downloading software or files from unknown senders. Any unusual or unexpected email communications should be reported to the appropriate Cybersecurity or IT teams.
Quishing - Microsoft Sway News Article: Microsoft Quishing Trend GitHub Link: Microsoft Sway Quishing GitHub Quishing, also known as QR Code Phishing, has become a notable threat with the recent release of Microsoft’s new product, Sway. This type of phishing campaign is particularly dangerous because it targets users on mobile devices, potentially bypassing the entire security stack in a corporate environment.
Company Awareness and Highlights Remind employees of the risks associated with interacting with QR codes using company devices. QR codes and their distribution should be controlled and restricted to professional use only, and should not be used for file sharing. Emphasize that company credentials should only be entered and stored on company-approved devices and through secure, authorized methods.
Comments