The bad guys going after your sensitive info keep getting smarter. And what’s worse, their latest strategies make their attempts look more legitimate — and more appealing, too.
Businesses, bloggers and publications long have tried to crack the code of getting their websites to the top of online search results. They use plenty of popular keywords or post about current events, trying to get search engines such as Google or Microsoft’s Bing to prioritize their pages as credible and up to date. There’s nothing wrong with that. Unfortunately, bad actors now have adopted those strategies, too. And they’ve been able to — at least temporarily — fool search engines, even making the links appear to be from trusted domains.
That becomes a major problem for security-conscious organizations. Many people now know to be wary of emails urging them to download files, click on odd-looking links, or input personal information. But a consumer actively doing an internet search rarely is on guard and probably expects the search engine to provide legitimate links.
Think of it as the new trend in Internet fraud.
This strategy — which some call SEO poisoning, and is basically phishing using search engines instead of emails — appears to be the next evolution of data stealing. Last year, this broad category of fraud (lumping together phishing, vishing, smishing and pharming) surged dramatically, according to the FBI’s 2021 Internet Crime Report. The report, based on complaints from the American public, showed nearly 324,000 complaints in that category last year, compared with a paltry 26,379 in 2018. And the stakes keep getting higher — losses hit $6.9 billion in 2021.
More specifically, cybersecurity research from Netskope found that phishing downloads jumped 450 percent during the 12 months ending March 31. The report highlighted malware downloads referred by search engines, particularly PDFs and malicious fake CAPTCHAs redirecting users to fraudulent websites.
The report also noted that cybercriminals appear to be getting more sophisticated: most of the malware during the research period was downloaded from within the same region as the victim. That means the malware was staged to avoid traditional prevention measures such as geofencing filters.
The lesson?
Never rest on your security laurels. For every fire we put out, the bad guys keep shifting tactics and lighting more. That’s why regular upgrades, training and evaluations are so vital.
The rapid rise in remote work caused by the pandemic provided the perfect environment for bad actors: Not only do they have more access because workers spend more of their time online, but they can use virtual meeting platforms as another way to get data. Many organizations, forced into a rapid switch to remote work, still are playing catchup in crossing all their security Ts.
Often, the most overlooked line of defense is also the most vulnerable — your people. Not only can Digital Silence test the resilience of your safeguards, we can test the resilience of your people — and train them with the most up-to-date information. Contact Digital Silence to find out how we can help protect you.
