Why a good password policy protects you against phishing
Quick Answer
A common business-email-compromise pattern: a vendor or customer falls for a phishing email and their credentials are stolen, the attacker changes the password, then uses the real account to send targeted emails to the victim's contacts using past correspondence, signatures, and even real invoice numbers. Each message includes a malicious spreadsheet or PDF. Because the email comes from a real, trusted account and references real history, it is very hard to detect. The defense: when a trusted contact sends an unexpected attachment, ask whether an attachment is genuinely needed, even if you trust the sender. Strong, unique passwords on all email accounts and MFA reduce the chance any single contact in your supply chain becomes the launchpad.
One of our vendors just alerted us to this Phishing scam that they have seen over the past few months. One of their customers has been hit with increasing frequency with an attack that follows this 5-step pattern;
-
- A known vendor or customer falls victim to a phishing attack. Their email credentials are compromised, and the “bad guy” gets access to their email account.
-
- They start by changing the password, so that the victim no longer has control.
-
- They then comb through past email correspondence and using the victim’s account, signature, and logo, send out targeted emails crafted to closely resemble legit correspondence they have had with our company in the past.
-
- Depending on the “bad guy’s” dedication to his craft, these could be fairly generic, or extremely specific. We’ve received one with an inquiry that referenced a specific real invoice # for that individual.
-
- The email always includes a spreadsheet or PDF. The name can be generic, or can be really specific. We’ve received one titled with a specific real invoice # for that individual.
Because these emails are coming from a real email account for a real business partner, they are very hard to identify, and in some cases they are literally impossible to detect, as they are carefully crafted copies of past legitimate emails. Naturally, there are a few that cast a wide net, so they are more generic and often contain corrupted grammar or spelling, but others are indistinguishable from real emails.”
The bottom line is on preventing this type of attack is to ask yourself – Is there a reason that this message has an attachment? Even though I trust the sender, does it seem out of place to get an attachment from them or a request to open an attachment?
Keep up your guard and your awareness and if you would like Phishing Protection for your company we would be happy to help.
General Manager
General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio.
Secure your email infrastructure
Protect, authenticate, and deliver. Contact our team to find the right solution.