Cyber Awareness Training

📌 How Phishing Works

1. 📝 The attacker **sends an email** disguised as a legitimate entity (e.g., PayPal, Microsoft).
2. 🔗 The email contains **a fake link** leading to a fraudulent login page.
3. 📩 The victim **enters their credentials**, unknowingly sending them to the attacker.
4. 🚨 The attacker **gains access** to the victim's accounts and may use or sell the information.

⚠️ Real-World Example: Microsoft 365 Credential Theft (2020)

Cybercriminals used fake Microsoft 365 emails to trick employees into **resetting their passwords** on a **phishing website**. Thousands of accounts were compromised, leading to **corporate data breaches**.

🛡️ How to Identify & Prevent Phishing

• ✔ **Check the sender email** – Look for misspelled domains (e.g., support@mícrosoft.com instead of **microsoft.com**).
• ✔ **Hover over links before clicking** – Verify if they match the legitimate website.
• ✔ **Avoid urgent requests** – Phishing emails often pressure users into immediate action.
• ✔ **Use Multi-Factor Authentication (MFA)** – Prevents account takeovers even if credentials are stolen.

🔗 View real phishing email examples →

📌 How Vishing Works

1. 📞 The attacker **calls the victim**, pretending to be an IT technician, police officer, or bank representative.
2. ⚠️ They create a sense of urgency ("Your account has been compromised! Act now!").
3. 🔑 The victim is tricked into providing **login credentials, PIN codes, or personal data**.
4. 💳 The attacker **accesses bank accounts or systems** to steal money or sensitive data.

⚠️ Real-World Example: IRS Tax Scam (2019)

Fraudsters impersonating IRS agents **called U.S. taxpayers**, claiming they owed unpaid taxes and threatened arrest if immediate payment wasn't made. Many victims paid using **gift cards or wire transfers**, losing **millions of dollars**.

🛡️ How to Identify & Prevent Vishing

• ✔ **Verify caller identities** – Hang up and call back using the official company number.
• ✔ **Never share personal details over the phone** – Legitimate companies won’t ask for full credentials.
• ✔ **Ignore calls that demand urgency** – Scammers use fear tactics to pressure victims.
• ✔ **Register your phone number with "Do Not Call" lists** – Reduces scam calls.

📌 How Smishing Works

1. 📲 The victim receives a text message **claiming to be from a bank, courier, or tech company**.
2. 🔗 The message contains a link to a **fake website or malware download**.
3. 🚨 The victim enters credentials, unknowingly giving them to an attacker.
4. 📂 The attacker **uses the stolen data to access accounts or commit fraud**.

⚠️ Real-World Example: Delivery Scam (2021)

Attackers sent fake **"Your package has arrived"** messages pretending to be from DHL and FedEx. Victims entered personal details on a **phishing website**, leading to identity theft.

🛡️ How to Identify & Prevent Smishing

• ✔ **Do not click on links from unknown numbers**.
• ✔ **Verify messages by contacting the company directly**.
• ✔ **Use spam filters** to detect suspicious texts.
• ✔ **Be cautious of messages with urgent requests** (e.g., "Your account will be deactivated!").

📌 How Baiting Works

1. 📂 The attacker **leaves infected USB drives in public places** (offices, parking lots, airports).
2. 💾 A victim **plugs the USB into their computer**, out of curiosity.
3. 🐍 The malware **installs automatically**, giving attackers control over the system.

⚠️ Real-World Example: Stuxnet USB Attack

The infamous **Stuxnet malware (2010)** was **spread via infected USB drives**, compromising Iran’s nuclear facilities.

🛡️ How to Identify & Prevent Baiting

• ✔ **Never plug unknown USBs into your device**.
• ✔ **Use endpoint security tools** to block unauthorized external devices.
• ✔ **Train employees to recognize baiting tactics**.