The Rise of Mobile Phishing and How to Manage It

The pandemic has revolutionized the way we communicate. Gone are the days when we had to get up from the sofa to talk with colleagues and employees. These days, all you need is access to a cell phone to zoom, send emails and schedule meetings. This convenience comes at a price, however.

With over 15 billion cell phones worldwide, it’s no wonder bad actors are turning to mobile devices to steal data and private information. Remote work and BYOD cultures have opened an even easier way for hackers to target corporate employees. One of the most damaging attacks: mobile phishing.

Phishing attacks have been around since the mid-1990s, when they originally targeted email. Today, they are more sophisticated and increasingly common on mobile devices. The high frequency at which mobile phishing attacks occur means more work for security operations center (SOC) teams to manage. Keep reading to learn more about the growing threat of mobile phishing and how to deal with it.

What is mobile phishing?

Mobile phishing is a type of phishing attack that uses mobile devices, such as smartphones and tablets, to deliver malicious content. Historically, phishing attacks have been carried out via emails and web pages. However, as the Internet has become increasingly mobile-friendly and people are spending more time on their phones than ever before (for example, Americans spend nearly 4.8 hours a day on their smartphones), cybercriminals have turned their attention to this new avenue of victimization. users.

Mobile phishing attacks can be harder to detect because they go beyond traditional email phishing. SMS attacks (smishing), malicious voice calls (vishing) and app-based phishing have exploded in popularity – and severity. And they’re harder to defend because they’re designed specifically for mobile devices and depend on your trust in the legitimate apps you already use regularly:

  • SMS/Text Messaging – Phishing texts typically impersonate banking apps, shipping providers, and even your CEO.

  • Voicemails – it’s more than your car’s extended warranty, vishing attacks will mimic the IRS, loan providers, etc.

  • Facebook Messenger – beware of suspicious links in messages, even from your Facebook friends.

  • WhatsApp – attacks can target victims within the app and via email.

What makes mobile phishing different from traditional phishing?

The difference between mobile phishing and traditional phishing is simple: the medium. While traditional phishing emails are sent via email, mobile phone phishing takes advantage of the fact that many people use their phones for banking, shopping, and doing business. This expansive attack surface includes SMS/text messaging, phone calls, voicemail, apps, and social media platforms.

Mobile Phishing Statistics

  • 74% of businesses fell victim to smishing attacks in the last year.

  • In 2021, 61% of businesses surveyed experienced phishing attacks on social media.

  • 51% of organizations allow employees to access company applications on their personal mobile devices.

  • Phishing attacks on mobile devices have grown at a steady rate of 85% per year.

  • 42% of organizations report that vulnerabilities in mobile devices and web applications have resulted in a security incident.

  • 75% of phishing sites specifically targeted mobile devices.

  • According to Google Safe Browsing, there are nearly 75 times more phishing sites than malicious sites on the Internet.

  • The Bank of Ireland was forced to pay out €800,000 to 300 banking customers following a single smishing attack.

Your mobile phishing response checklist

Mobile phishing scams happen around the clock, so make sure your defense is always ready. Here are some areas to consider for your phishing defense and response:

  • Educate employees: Prevention is your best defense. Make sure mobile phishing security is included in regular employee security training. Highlight common red flags and real-world examples so employees know what to watch out for. Establishing a security-focused culture within your organization can reduce the number of successful phishing attacks.

  • Collect evidence: Encourage employees to send screenshots of all malicious texts, messages and emails from the targeted mobile device (and remind them to block the sender). If an employee is the victim of a phishing attempt, it is essential to know what the successful attack looked like.

  • Analyze data: Your security team can quickly identify attack trends once enough data is collected. For example, if you notice an increase in smishing attacks impersonating the CEO, this is a great opportunity to send out company-wide security alerts.

  • Have an incident response plan: Did an employee click on the wrong link or share private information? So here we go – activate your IR procedures. Make sure your team has documentation of the steps to follow: from quarantining devices to searching internal systems to reviewing logs for other affected users.

  • Establish a BYOD policy: Creating a Bring Your Own Device policy is a necessity, whether in the office, hybrid or remote. Include metrics for employee departures, device loss, theft, and device updates.

Triage phishing with modern tools:
Security Automation

Mobile phishing attacks will continue to grow in frequency and sophistication. Remote work and our reliance on mobile devices will further fuel these attacks. And with security teams receiving thousands of alerts daily, executives are looking for options to stay ahead of phishing threats.

Security automation platforms offer solutions to combat the rise of mobile phishing attacks. The benefits of automation include:

  • Save SOC analysts time with automatic investigation and quarantine

  • Gain visibility into phishing attempts from the dashboard

  • Block false positives with fully automated workflows

  • Improve efficiency with real-time case collaboration

  • Improve security metrics, such as mean time to resolution (MTTR) reduction

The addition of automation is intended to empower SOC teams to stop more threats faster. These platforms automate repetitive and mundane tasks that waste SOC analysts’ time.

Learn how low-code security automation can be used to triage phishing alerts.

https://www.youtube.com/watch?v=bzbdhhdOBR4

Whether you introduce security automation into your SOC or implement a manual IR process, mobile phishing should be on your threat radar. Educate employees, secure the growing attack surface, and implement a thorough incident response process.

*** This is a syndicated blog from Swimlane’s Security Bloggers Network (en-US) written by Ashlyn Eperjesi. Read the original post at: https://swimlane.com/blog/mobile-phishing/

Comments are closed.