(Apr 20, 2023 10:44 AM)Jess234 Wrote:  Can you dm me because i can't dm you

(Apr 20, 2023 09:40 AM)Beτα Wrote:  Bellow you will find most common SE methods explained , examples and ways to protect yourself.


Phising :

Phishing is a type of social engineering attack where a scammer tries to trick you into providing sensitive information such as passwords, credit card numbers or other personal data. This is often done through email, text message, or a fake website that looks like a legitimate one.

Example :

Code

Subject: Urgent

Dear Customer,

We have noticed some unusual activity on your account, and we need you to take urgent action to secure it. Please click on the link below and enter your login details to verify your identity.

[phisinglink]

If you do not take action within the next 24 hours, your account may be suspended, and you will not be able to access your funds or make transactions.

Thank you for your cooperation.

Sincerely,
The Security Team

Note that the message may look legitimate, but the link will lead to a fake website designed to steal your login credentials. It's important to always double-check the sender and the website before providing any sensitive information.

Whaling :

Whaling social engineering, also known as "CEO fraud," is a type of phishing attack that targets high-level executives or individuals in positions of power. The attacker sends a message that appears to be from a senior executive, such as the CEO, CFO, or COO, to an employee with access to sensitive information or funds. The message is often urgent, requesting the recipient to transfer a large sum of money to a specific account or provide sensitive information, such as login credentials or financial data. The message may also contain a sense of urgency or threat, such as the need to keep the transfer confidential.

Code

An attacker impersonates a high-ranking executive within a company and sends an email to an employee in the HR department. The email appears to come from the executive's personal email address and is crafted to look legitimate by using the executive's name, signature, and company logo.

The message requests that the employee send over a file containing sensitive information, such as W2 forms, for all employees within the company. The email also includes a sense of urgency, stating that the information is needed immediately for a confidential business deal.

The employee, believing the message to be legitimate, sends over the requested file. It is only later discovered that the executive's email account had been hacked and the message was fraudulent.

How to defend :

Be cautious of any unexpected or suspicious messages that ask you to provide personal information, click on links, or download attachments. Always double-check the sender's email address or website URL to see if it matches the correct source, as scammers can create fake websites that look same to the originals. Enabling multi-factor authentication on all your accounts provides an extra layer of security by requiring a second factor, such as a fingerprint or one-time code, to log in. Keeping your software and security systems up to date by installing the latest updates and patches can help to protect against known vulnerabilities and threats. It's also helpful to educate yourself and others on how to spot phishing messages


Extra for whaling :

Monitor accounts: Monitor accounts regularly for any unusual activity & Educate employees

Diversion Theft :

whensomeone uses text messages to trick you into giving them your personal information. They might send you a text message that looks like it's from a legitimate source like your ba