W is for Whaling — An Attack on Whales!

Whaling or Whale Phishing or Whaling Phishing, call it whatever you may, it is one of the most well-planned attacks on the whales aka the C-suite executives of an organization.

The aim behind Whale Phishing is to trick the executives into doing what the Whale attackers want them to do. That could range from money siphoning to stealing sensitive and confidential data.

So, what exactly is whaling phishing?

Whaling Phishing Attack: The Definition, Identification, and Prevention

Before I talk about what is whaling phishing, understand this:

About 72% of whaling attackers pretended to be the CEOs, while 36% were attributed to the CFOs.

Note: If you are a small business owner or a medium-size enterprise you can be at higher risk for a variety of reasons but the most prominent being –

Whaling Phishing Attack ➖ targets C-Suite Execs!

LACK OF PROPER CYBERSECURITY MEASURES IN PLACE.

So,

What Is Whaling Phishing Attack?

Whaling Phishing Attack, as defined by Toolbox, is a cyber-attack wherein cybercriminals disguise themselves as members of a senior management team or other high-power executives of an establishment to target individuals within the organization, either to siphon off money or access sensitive information for malicious purposes.

Image source: https://view.publitas.com/p222-2315/whaling-phishing-for-the-big-c/page/1

How Does Whaling Work?

Whaling attackers do a lot of groundwork before they attack their target. The groundwork includes –

• Stalking the target’s social media sites
• Fetching information on all the deals related to the individual
• Sourcing the current turmoil in an organization
• Studying the pattern of the target – like what the person likes to eat, drink, where they go for a holiday – yes, it is like stalking – but digital stalking

Once all these details are obtained, attackers plan either a call or an email, or an SMS that looks believable enough for the target to do the required action.

How to Identify a Whaling Phishing Attack?

• Red flag all the emails coming from external sources
• Cross-check all the sensitive requests received
• Watch out for near-similar email domains
• Look out for any suspicious links in the email received
• Try to confirm the source of unsolicited attachments
• Find out any spelling errors or grammatical issues, including the writing style issues

Image source: https://www.toolbox.com/it-security/vulnerability-management/articles/what-is-whaling-phishing/#lg=1&slide=0

Some Practices to Help You Stay Alert and Avoid Whaling Phishing Attack

1. Awareness regarding whaling phishing attacks should be made a priority, especially for SMEs and MSMEs
2. Ensure that the higher management including CEOs and CTOs are stakeholders
3. Clear and regular communication with your staff and all the stakeholders regarding Whaling Phishing is a must
4. Ensure there is a whaling phishing training in your company and keep the training simple and jargon-free
5. Regular whaling phishing drills will ensure that everyone is ready when an actual attack happens
6. Empower all the employees across all the levels, and encourage an open-door policy in your organization

These are a few of the ways you can practice ensuring you are safe from a whaling phishing attack.

Remember prevention is always better than a cure. Practice safe online practices and ensure robust cybersecurity.