Phishing, spear phishing, vishing, and smishing: four forms of one attack

The only thing the same across all four is the intent: to get from a person something the technical protection wouldn’t hand over by itself. What differs is the cost of preparation and the channel, and with them how easily the attack is recognized.

Phishing is a mass send in which the attacker knows nothing about the recipient and relies on numbers. The template is usually bought or copied from the real sender: a bank, a courier, a shared document, a password expiry. The economics rest on volume: even a tiny success rate over enough messages gives the attacker a result, so the quality of the text doesn’t matter.

That is exactly why it is the easiest to spot. A generic greeting, a domain that differs by one character, and pressure to act immediately. The catalog of attacker techniques lists this one under the label T1566 and distinguishes four variants by what the message arrives as: an attachment, a link, an invitation to a service, and a voice call.

Spear phishing is the targeted version, aimed at a handful of people and built on what is public about them. The attacker reads LinkedIn profiles, the annual report, and the format of company addresses, then writes a message that fits a project currently under way. Preparation is counted in hours instead of seconds, and the success rate matches. Where the attacker gets the names and roles is described in more detail elsewhere.

It most often aims at people who send money or hold access: finance, executive assistants, administrators. That this isn’t only a foreign phenomenon is documented by the NÚKIB recommendation on spear phishing (in Czech): among the Czech organizations hit it names hospitals, universities, and financial institutions, from which the attackers wanted credentials and money. The giveaway usually isn’t the text, which fits, but a detail around it: a different sender domain, a new account number, a request to keep it from colleagues.

The same fraud moved to the phone and to text messages. Vishing is a call in which the attacker poses as IT support, a bank, or a supplier and pushes for immediate action, because on a call there is no time to verify anything. Smishing is a short message with a link, most often about a parcel, a payment, or a blocked account.

Both channels get around most of the technical protection: a call doesn’t pass through the mail gateway, and a text message opens on a phone, outside the company filters and device management. The catalog of techniques lists the voice variant twice and splits it by what the attacker is after. When the call only pulls out information for a further attack, it is T1598.004 among the reconnaissance techniques. When the call is meant to open the way inside straight away, it is T1566.004 among the initial access techniques.

Attackers combine channels because two channels together work better than one. The typical sequence is an email and then a call: the message announces an invoice or a change in a system, and an hour later a person calls, refers to it and walks the victim through to a payment or to entering a code. The second channel supplies credibility the message alone doesn’t have.

Phishing is combined with bypassing multi-factor authentication in the same way. The message pulls out the password, the call the one-time code, or instead of a password all that is asked for is approval of a login on the phone. The four boxes from the glossary are therefore useful for describing an attack, not for building a defense: the defense has to count on both arriving at once.

A fraudulent message isn’t recognized by mistakes in the language; those stopped being the rule long ago. Three things are more reliable: an unusual request (a change of account number, forwarding a code, installing a remote access tool), pressure on time, and a channel that doesn’t belong to that request. A change of bank details announced by text message is suspicious no matter how it is worded.

The second layer is technical: a sender domain one character off, a link pointing somewhere other than its label, an attachment in a format that doesn’t match the content. And one rule holds for all four forms. Verification goes back through a channel the recipient picks, not through the one the caller or the sender offered.

Email can be exercised without trouble, the phone with preparation, and text messages only rarely. An email campaign can be prepared and evaluated in numbers, so a campaign run against your own people is the basis. Vishing is exercised person by person and measures worse, because every call goes differently and the results don’t add up into one percentage. In the list of what can be tested, testing people is a separate type of test.

Scenarios that play out away from the screen belong to a physical test, because they need different authorization and different rules. Scenarios that end at the entrance are often combined with a fraudulent message: a call announces a technician, and then the technician is standing in the doorway.

A category of its own is quishing, a link hidden in a QR code that many mail gateways don’t read. We cover it in an article on what is currently getting through the filters.