Increased “Shipping Delays” Now Served as Phishbait

Attackers are exploiting pandemic-related supply-chain disruptions to launch phishing campaigns, according to Troy Gill, senior manager of threat intelligence at Zix. In an article for Threatpost, Gill describes a phishing attack that impersonated a major shipping company.

“[R]ecently the Zix Threat Research team uncovered a spoofing attack where the threat actors posed as one of the largest container-shipping lines in the world,” Gill says. “The email encouraged the recipient to download a shipping document confirmation by clicking on a malicious link. If the user compiled, they would be directed to a very convincing phishing page that cycled through different realistic-looking company backgrounds, with a sign-in screen overlay meant to steal the user’s email credentials.”

Gill points out that these phishing emails, like many social engineering attacks, instill a sense of urgency to compel users to click the link.

“Another continuing trend involves generating a feeling of pressure and urgency to keep recipients from giving it too much thought before responding or following the link,” Gill writes. “Of late, this tactic has become more convincing and subtle, such as stating individuals will lose access to a valuable account if they do not respond immediately.”

Gill concludes that organizations need to use a combination of employee training and security technologies to defend against phishing attacks.

“Although spoofing attacks are continuing to evolve, the burden on organizations can be lessened by implementing the right training and adopting the most effective technology solutions to keep email, employees and the company as a whole protected,” Gill writes. “Shipping and logistics companies are dealing with a lot of uncertainty right now, and so are their customers. The strength of companies’ cybersecurity posture doesn’t need to be another question mark.”

External stressors like the COVID pandemic can have important implications for the threats a business faces. New-school security awareness training can give your organization an essential layer of defense by enabling your employees to spot phishing attacks.

Threatpost has the story.