Phishing Schemes Are Using Encrypted Sites To Seem Legit



phishing sites hosted on https

WIRED wrote: "A MASSIVE EFFORT to encrypt web traffic over the last few years has made green padlocks and "https" addresses increasingly common; more than half the web now uses internet encryption protocols to keep data protected from prying eyes as it travels back and forth between sites and browsers. But as with any sweeping reform, the progress also comes with some new opportunities for fraud.

And phishers are loving HTTPS...

"On Tuesday, the phishing research and defense firm PhishLabs published new analysis showing that phishers have been adopting HTTPS more and more often on their sites. When you get a phishing email or text, the sites they lead to—that try to trick you into entering credentials, personal information, and so on—implement web encryption about 24 percent of the time now, PhishLabs found. That's up from less than three percent at this time last year, and less than one percent two years ago."

"PhishLabs' Hassold notes also that the real problem anyway isn't phishers getting a certificate and implementing HTTPS; it's the green padlock they gain that then gives consumers a false sense of security. Where the padlock simply indicates that traffic between the server and the user's browser is encrypted and protected against interception, consumers often assume that a green padlock means that the site is more generally secure.

"For the average internet user, the important thing is still following the basic steps to avoid being drawn in by phishing schemes. And don't assume that any page that has HTTPS contains legitimate and authentic content. It's a green padlock, not a silver bullet." Read the whole article at WIRED.

Clear as daylight that you still need to step your users through new-school security awareness training to make sure they do not get tricked by social engineering tactics like this. 


Free Phishing Security Test

Did you know that 91% of successful data breaches started with a spear-phishing attack?

Cyber-attacks are rapidly getting more sophisticated. We help you step your employees throuigh new-school security awareness training to better manage the urgent IT security problems of social engineering, spear-phishing and ransomware attacks. Take the first step now. Find out what percentage of your employees are Phish-prone with our free test. 

Get Your Free PST Now

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

https://www.knowbe4.com/phishing-security-test-offer

Topics: Social Engineering, Phishing, Security Awareness Training

Subscribe To Our Blog


Recent Posts




Get the latest about social engineering

Subscribe to CyberheistNews