With the number of malicious online attacks increasing daily, the importance of protecting your employees from succumbing to email scams can’t be overstated. Because email is so integral to your company’s financial success, having the best defense against phishing and spoofing efforts not only improves your brand reputation, it also reinforces customers’ trust in your business. After all, nobody wants to receive illegitimate messages, thus tarnishing perceptions of their preferred brands. One of the more damaging kinds of phishing attacks is whaling. The term “whaling” was coined because of the magnitude of the targets and attacks relative to those of typical phishing ploys.
What Is Whaling Phishing?
A whaling attack, also referred to as whaling phishing, is a specific form of phishing attack that explicitly targets high-profile employees—CEOs, CFOs, or other executives (known as whales)—in order to steal sensitive information from a company. Whales are carefully chosen due to their overall authority and access to secure company information. The goal of a whaling attack is to con an executive into revealing personal or corporate data through spoofed email. In most whaling attacks, the perpetrator’s goal is to manipulate the victim into authorizing lucrative wire transfers to the attacker.
How Do Whaling Attacks Work?
As mentioned, the aim of whaling phishing attacks is to trick an individual into disclosing personal or corporate information through social engineering, email spoofing, and content spoofing efforts. For example, the fraudster might send the unsuspecting victim an email that appears to be from a trusted source, enticing the whale to provide classified data. In addition, some whaling campaigns include a customized malicious website created especially for the target.
Whaling attack emails and websites are highly customized and personalized, and they often incorporate the target’s name, job title, or other relevant information collected from a variety of sources. Due to this level of personalization and their highly targeted nature, whaling attacks are usually more difficult to detect than standard phishing attacks.
Whaling phishing attacks often rely on social engineering methods, as attackers will send hyperlinks or attachments to infect their victims with malware or to solicit sensitive information. By targeting high-value victims, fraudsters might also persuade them to approve fraudulent wire transfers using business email compromise techniques. In some cases, the attacker impersonates the CEO or other corporate officers to convince employees to carry out damaging financial transfers.
Examples of Whaling Attacks
Perhaps the most notable whaling phishing attack occurred in 2016 when a high-ranking Snapchat employee received an email from a fraudster impersonating the company’s CEO. The employee was duped into giving the attacker confidential employee payroll information. The FBI subsequently investigated the attack.1
Another newsworthy whaling scam from 2016 involved a Seagate employee who unknowingly emailed the income tax data of several current and former company employees to an unauthorized third party. After reporting the phishing scam to the IRS and FBI, it was announced that thousands of peoples’ personal data was exposed in that whaling attack.2
MxToolbox’s Delivery Center
Although information security awareness training for all employees and executives is recommended, it’s far from a foolproof plan. In fact, even highly educated users fall to malicious email scams, with their aggregate click-through rate granting an attacker a 10% chance of success per trained employee.3 To that point, MxToolbox advises all businesses immediately adopt DMARC and select stringent quarantine/reject enforcement. Our Delivery Center product and expert team can help your company implement DMARC and publish aggressive enforcement, along with monitoring email spoofing traffic before a dangerous whaling attacker impersonates your respected domain.
1 https://money.cnn.com/2016/02/29/technology/snapchat-phishing-scam/index.html
2 https://krebsonsecurity.com/2016/03/seagate-phish-exposes-all-employee-w-2s/
3 https://info.microsoft.com/ww-landing-Security-Intelligence-Report-Vol-23-Landing-Page-eBook.html