Phishing campaigns: the need for vigilance in the face of a growing scourge

Phishing attacks are one of the most widespread and devastating threats to cybersecurity today.

By posing as trusted entities via e-mails, SMS messages, fraudulent websites, and more recently even booby-trapped QR codes, cybercriminals are able to trick their victims into providing them with sensitive information such as IDs, passwords or bank details. The growing number of such campaigns highlights the urgent need for organizations to arm themselves against this threat.

Phishing: an increasingly sophisticated threat

The rise of phishing: what's behind it?

The increase in phishing campaigns can be explained by the growing number of online users, creating more potential targets for cybercriminals. Phishing campaigns are also on the rise due to the use of advanced technologies such as artificial intelligence, but above all due to the increasing flow of information on the Internet. Indeed, users are sharing more and more personal information online, particularly through social networks, giving criminals the opportunity to use this data to make their phishing content more personalized and credible.

Phishing also relies on social engineering, exploiting the vulnerability of human emotions such as fear, urgency or curiosity. Cybercriminals then use these levers to entice individuals to click on malicious links or download infected attachments. Although email filtering technologies have progressed, these attacks remain particularly effective because they often target the end-user, considered the weakest link in the security chain.

It's also worth bearing in mind that, in an age of ubiquitous digital technology, it has become easier for cybercriminals to exploit personal data in transit on the web to create ever more credible campaigns. However, the lack of prevention in the face of these phishing techniques, and security measures that are often inadequate, facilitate these attacks.

A variety of existing phishing campaigns

Detecting phishing campaigns is becoming increasingly complex these days, as they come in a wide variety of forms. The most common phishing techniques include :

• Email phishing: Cybercriminals send fraudulent emails with links to dummy sites or infected attachments, posing as legitimate companies. Their aim is to retrieve sensitive information or install malware.
• Smishing: Similar to email phishing, smishing uses SMS messages to trick victims into clicking on malicious links or giving out confidential information. The messages appear to come from legitimate entities, such as banks.
• Quishing: A form of phishing using malicious QR codes to trick users. By scanning these codes, victims are redirected to fraudulent sites designed to steal personal or sensitive information. It is therefore crucial to check the source of QR codes before scanning them.
• Spear phishing: This form of phishing is more targeted and often more elaborate. It targets specific individuals, often within an organization, and uses personal information to make the message more credible.
• Vishing: Vishing is carried out by telephone. Cybercriminals pose as representatives of financial institutions and attempt to obtain sensitive information such as credit card numbers or passwords.
• Clone phishing: This technique duplicates a legitimate email already sent, and adds malicious links or attachments. The email appears authentic, but redirects to fraudulent sites.
• Pharming: Pharming redirects users from a legitimate website to a fraudulent one, often by compromising the DNS system. Users don't need to click on a link; the redirection happens automatically.

To combat these threats, it is essential to raise user awareness and reinforce security measures.

The NIS2 directive: a stricter framework for organizations

Against this backdrop, the NIS2 directive, which came into force on Thursday October 17, 2024, imposes new cybersecurity requirements on companies and institutions. It extends its scope to many critical sectors, requiring better management of cyber risks.

NIS2 also introduces increased responsibility for company directors. They must now ensure that their organization adopts robust protocols against phishing and other threats, failing which they risk heavy financial penalties, such as fines of up to 10 million euros or equivalent to 2% of global sales for non-compliant companies. This directive therefore represents an opportunity to strengthen companies' defenses against these insidious threats.

At the same time, the directive stresses the importance of employee awareness and ongoing training for effective cybersecurity. Regular training helps prevent cyber threats, as well-trained employees are better equipped to remain vigilant in the face of new threats. In the same vein, NIS2 also encourages the reinforcement of technical skills within IT teams, so that they have the necessary knowledge to guarantee the protection of critical infrastructures.

In addition, the integration of awareness training helps to establish a security culture within the organization, where every employee understands the importance of protecting information. Finally, it helps ensure compliance with the directive's requirements, reducing the risk of non-compliance and potential penalties.

Phishing campaigns: how to prevent and avoid them?

The importance of raising employee awareness

In the face of increasingly sophisticated phishing techniques, employee training and awareness are essential to ensure a company's long-term survival. Indeed, the majority of successful attacks are the result of human mismanagement, whether it's a click on a fraudulent link or the transmission of sensitive information to malicious third parties.

For example, in March 2018, the French Pathé group fell victim to targeted phishing fraud via a Business Email Compromise (BEC) technique. Cybercriminals posed as company executives and convinced the Dutch subsidiary to transfer large sums of money in installments totaling over 19 million euros. The attackers used fraudulent e-mails with a very credible appearance, while ensuring that the recipients did not tell anyone about the operation.

More recently, in 2023, a sophisticated phishing campaign targeted Microsoft 365 users. Cybercriminals used seemingly legitimate links, including those from Chinese search engine Baidu, to redirect victims to fraudulent sites designed to harvest their credentials. The idea was to gain access to their Microsoft 365 accounts, to carry out further attacks and gain access to sensitive data. In particular, the attackers used JPEG images containing references to "Microsoft Office 365", making phishing detection difficult.

These incidents illustrate just how crucial employee training and awareness are in preventing simple human errors from leading to massive financial and operational losses. A proactive approach means regularly training employees to recognize phishing attempts and react appropriately, because understanding phishing techniques means better detection and protection. This is where Olfeo Awareness comes in, our e-learning solution dedicated to cyber security awareness.

Olfeo Awareness: a powerful phishing prevention tool

Faced with all the cybersecurity issues that companies can face, it is crucial for them to arm themselves effectively against these potential attacks, and to involve employees in their cyberdefense strategy through awareness-raising tools.

Olfeo Awareness is a complete SaaS solution for raising awareness of cybersecurity issues. In fact, it is an e-learning tool offering a set of over 110 customizable, interactive and fun training modules that enable employees to effectively raise their awareness of cyber risks. Thanks to realistic phishing tests and simulations featuring concrete examples in video form, users can familiarize themselves with the techniques used by cybercriminals, and thus reduce the risks of compromise by learning to identify the various forms of phishing, malware, ransomware and identity theft.

The Olfeo Awareness E-learning platform offers several benefits:

• Easy to use and install: Olfeo Awareness is accessible to all levels of IT expertise, and is quick and easy for administrators to deploy.
• A comprehensive training catalog: The tool features a rich and evolving training catalog covering all the cyber risks impacting employees (phishing, password management, in formation protection, etc.).
• Real-life simulations: Training to recognize fraudulent e-mails, suspicious attachments and dummy websites through phising tests, for example.
• Personalized content: Courses are adaptable to different user profiles for maximum efficiency (newcomers, experts, cyberheroes, essentials, etc.).
• Varied formats: The platform has been designed to keep employees interested, with a variety of interactive training formats such as videos, skits, MCQs, chatbots and interactive books.
• Individual progress monitoring: Thanks to detailed reports, managers can track the development of their teams' cybersecurity skills.

By integrating Olfeo Awareness into your defense strategy, you not only improve your company's protection against phishing attacks, but also comply with the cyber risk management obligations of the NIS2 directive.

In short, the combination of cutting-edge technology (anti-phishing filters, advanced detection tools) and ongoing employee training is the best way to prevent incidents. By opting for tools such as Olfeo Awareness, companies can effectively defend their digital infrastructures.

Conclusion: continuous awareness-raising as a solution

Phishing campaigns will continue to evolve and become increasingly sophisticated. In this context, compliance with the NIS2 directive and employee awareness are key to reducing the risk of cyber-attacks. Olfeo Awareness is an indispensable ally for any organization wishing to protect itself against these threats, while reinforcing the culture of cybersecurity within its teams.

Make cybersecurity a priority today and protect your organization against phishing with Olfeo Awareness, your ally against constantly reinventing phishing campaigns.