In fact, we could say “especially for cybercriminals.”

Thanks to online shopping trends, an annual spike in online activity between November and December presents a field day during which scammers can do their thing. That’s a habit that’s only likely to stick around (and/or increase) as more people opt out of fighting crowds in favor of one-tap couch couponing.

So, before you fire up your preferred browser, open up all those tabs, and cash in on all those great deals, take note of these online shopping scams that you should be on the lookout for.

Fake Sites

Phony websites that are built to mimic big, well-known brands are a common sight around Christmas time. On these fraudulent websites, you’ll find low prices, unrealistic promises, and unbelievable deals that are often too good to be true.

As it turns out, it’s because they are.

Instead of big savings, you’ll find yourself in big trouble when you fall for this deceptive front for malware, phishing, and other malicious cyberattacks. The best way to tell whether or not you’re on a fake page or the real thing? Fake ones are typically riddled with popup ads, misspelled words and links, sloppy design, and unusual, overreaching information requests.

Phishing

Deal-related promotion emails are a common sight for anyone with an email address in 2021, especially around the holidays. This clutter of messaging presents the perfect opportunity for scammers to sneak their way into your inbox. Scam filters don’t always catch them, though, so the need to be extra vigilant when it comes to which emails you open and read is extra crucial. Red flags for holiday sale-related phishing emails include:

• An unknown sender.
• False coupons.
• Flash sales that seem too good to be true (again, they are).
• Sloppy brand impersonation attempts.
• Suspicious update text messages that you didn’t request.

Fake Digital Ads

Pop-ups. We’ve all seen them, and they’re still around today. While some of them are trustworthy, many of the ones you see while shopping for everything on your wish lists are bound to include what you’ll find on a fake site that’s likely hiding behind the link on them. Remember: anything that features an unrealistic price, misspelled links or words, or suspicious branding/design should be avoided.

Online shopping should be convenient without putting you at risk of your financial info being stolen. Taking advantage of something popular and in-demand during a high-traffic time of year is classic cybercriminal behavior, and these online shopping scams are shining examples.

Do you want some help training your team on how to better recognize behavior like this during the holidays and beyond?

A scammer’s job is never done, and neither is ours. Contact us today for help protecting your business.

But as always, cybercriminals are always working to stay one step ahead of the measures put between them and their goal. Your trusted email scanners are no different.

You don’t want to fall victim to a phishing attack that looks like it belongs with the other meeting invites, newsletters, and company updates in your inbox. So, if a cybercriminal does end up making it past your email’s security protocols, here are a few things to be wary of.

• Cybercriminals might replace words commonly found in phishing emails (such as “invoice”) with synonyms to bypass filters that are set to be on the lookout for those keywords.

• A dark web tool, “Email Appender,” gives any cybercriminal with a set of compromised email account credentials the ability to place a malicious email directly into the inbox of that victim’s mailbox, bypassing any mail scanners, virtual sandboxes, and other security solutions.
• Brand exploitation is a method most phishing attacks use to weasel their way into an unsuspecting person’s email account. By posing as a trusted business or financial institution, cybercriminals can deceive email scanners into giving access to an email that looks just like the ones they get every day from the real source. Read more about this type of phishing here.
• Sometimes, a cybercriminal might even put the recipient’s email address in the subject line of the phishing attack.
• Vendor email compromise (VEC) and business email compromise (BEC) are also ways cybercriminals have attempted to sidestep email security. Much like brand exploitation, a phishing attack like this is meant to look like they’re coming from people that you trust, whether they be internal employees or authorized, frequently-interacted-with vendors. This Blue Layer blog digs deeper.

Simply put, a phishing attack is designed simply to trick. And sometimes, even the sophisticated technology designed to resist these tricks falls for them, too. And when the technology fails, it’s on the user to ensure that the cybercriminal’s last intended step is not followed through.The only way to guarantee that involves a combination of the most effective cybersecurity technology and modern cybersecurity awareness training for those who interact with it. We can help with both. Click here to learn how Blue Layer can protect your business and your employees.

Of all the cryptocurrencies being talked about today, Bitcoin (BTC) is the one you’ve likely heard the most about, thanks to its accessibility and the groundbreaking headlines it’s made in recent months. Unfortunately, the hype surrounding it has also caught the attention of cybercriminals, and they haven’t hesitated to capitalize on it—even for a moment.

Since cryptocurrency is still considered to be in its infancy stages, there’s a lot of mystery and misinformation surrounding the growth of this decentralized asset. This can make it difficult for newcomers to discern fact from fiction on something that can already be a challenge to understand, so we’re here to help you clear the air and make only the smartest and safest decisions regarding where your money goes.

While BTC is something worth looking into, it’s not something worth ditching your cybersecurity due diligence for. Here are some common phishing attacks to look out for while adding to your new crypto wallet.

Suspicious Log-In Emails

This is a classic phishing strategy that uses a fake email alerting users of a suspicious sign-in attempt to their wallet. Emails like these will appear to be from reputable Bitcoin-related websites and ask for users to click on a malicious link that will prompt them to enter their private login information. Once this information is provided, the cybercriminals on the other end will have access to the user’s account, giving them the ability to empty their wallet.

Phishing campaigns like these are known for using popular social engineering tactics to make their attempts look as legitimate as possible, and it’s working. One report found that the click-through rates on Bitcoin phishing emails are higher than that of other phishing scams.

Sextortion Emails

Instead of asking for login credentials, BTC sextortion emails claim to have evidence of a users’ browsing history to blackmail them into providing payment in the form of Bitcoin wallet deposits. Beware: sometimes, these cybercriminals do research on their intended victims to increase their chances of eliciting the response they want. Don’t fall for this common social engineering tactic!

Google Docs Scams

This is another scam that exploits the Google Doc functionality that many of us know and use every day to trick BTC miners into giving up thousands of dollars worth of crypto. First, users receive an email notifying them that they have been mentioned in a Google Doc by a familiar party informing them that hard-to-come-by mining equipment has become available for a limited time. Then, after the provided link is clicked, they are led to a very convincing website that offers rare equipment in exchange for Bitcoin. Of course, this page is fake, and once payment is processed, funds are lost.While this particular incident targeted miners and not the everyday investor, it should still be noted that scams like these exist and are becoming increasingly convincing. Click here for a more detailed look at how this scam works.

Outdated Bitcoin Wallet Software Exploitation

When a software update is released for any platform, it can often include important security measures that are put in place to thwart cybercriminals from exploiting vulnerabilities that might have been identified in earlier versions. One scam like this found a user supplying their login credentials to a malicious source to the tune of roughly $16 million.

The lesson? Always be wary of credential requests and always use the most up-to-date software.

As cryptocurrency continues to grow, we can only expect attempted attacks on investors to do the same. Always stay on your guard and practice smart cybersecurity habits whenever interacting with technology, especially when it comes to something that you may be new to and especially when it involves your hard-earned money.

Do you have questions about what smart cybersecurity habits look like? Just looking for some help making sense of it all? Click here to learn how Blue Layer can protect your business and your employees.

Recently, cybercriminals have been producing malicious phishing websites that look identical to the Google login page that we’re all very familiar with and hiding them behind false, yet convincing, invitation emails and landing pages.

Here’s how it works.

First, a person might receive an email from what they believe to be a trusted source directing them to a Google Docs link that looks like the ones you’ve received countless times before.

After clicking the link, they are directed to a custom HTML page that looks like another familiar Google Docs share page. That page will lead the person to “Click here to download the document” to which they think they are receiving access.

Once that second link is clicked, they will be directed to a login page that has been made to look like the Google login portal. However, it’s here that they will find the actual malicious site where their credentials are to be compromised.

Get a more in-depth look at these types of attacks and how they are created here: Attackers Take Advantage of New Google Docs Exploit

This is another prime example of how phishing targets users by exploiting their trust in a source that would otherwise be trustworthy. Attacks like these prove all tools (even the ones that you think are the most secure) can be made a target and that we should always assume cybercriminals can compromise anything in the absence of our constant vigilance.

Do you want to make your team’s vigilant ability to recognize bad content razor-sharp? Add awareness training to your cybersecurity mix, and you’ve got a team that can’t be fooled, no matter how convincing the phishing attacks that they encounter might be.

Click here to learn how Blue Layer can help protect your business from these and other cyber threats.

What is a vendor email compromise?

VEC is a type of business email compromise (BEC) that goes after a company’s critical supply line information instead of targeting the employees themselves, as we see with things like CEO fraud.

• First, VEC hackers will monitor a business’s transaction habits and use that data to pinpoint one specific vendor of theirs that would be most lucrative to scam.
• Second, they draft phony emails addressed to these vendors that look almost identical to the real thing.
• Then, they will use hacked email accounts to send requests for payment to their customers.
• Since these invoices are modeled after ones that go out to these customers all the time, vendors will often proceed to pay them, not realizing that they direct to the hacker’s bank accounts and not the legitimate source.

What is the result of a successful vendor email compromise?

Tremendous cost, according to KnowBe4. The average cost of a VEC attack? A whopping $183k! Not to mention compromised vendor information and business financial details.

Is your business at risk?

According to the same linked article from KnowBe4, the chances of getting hit during any given week have increased by over 80% between Q3 of 2020 and January of this year. That’s a giant leap in a small amount of time, meaning that your entire team should always be as vigilant as possible.

Unfortunately, cybercriminals will never stop working on new ways to make something appear to be what it is not. It doesn’t help when they are particularly good at their job, making it harder and harder to combat them day-to-day. Especially when their attacks start to look like an email you might receive on a normal workday!

So, if your business works with vendors that sound like they could be vulnerable to the attack that we’ve described, then you should pursue cybersecurity awareness training for all of your employees that work directly with financial transactions. It will help them understand the scams they’re up against and how to avoid falling into the traps set in front of them.

Click here to learn how Blue Layer can help protect your business today.

Now, things are different.

Now, technology like video verification makes things like online banking (another phrase that meant nothing only 20 years ago) even more convenient, if you can believe it.

What is video verification?

Video verification is a technique used by businesses to verify the identity of customers attempting to access their account information, either with a video interview facilitated by the business itself or with customer-submitted photos or videos.

Sounds foolproof in theory, right? How could a cybercriminal possibly work around having to verify themselves in real-time on camera? Thanks to the evolution of deepfakes, it’s becoming more and more likely that they can… and will.

What are deepfakes?

In short, deepfakes are any media that is fabricated by AI or deep learning methods. More simply put, it’s a new and improved way for cybercriminals to trick their victims (businesses and individuals alike) into seeing what isn’t really there.

The most troubling form of media that the rise of deepfakes has manipulated is found in an example that indicates just how sophisticated this technology really can get: video deepfakes. According to KnowBe4, “Face swapping or puppeting is where the deepfake AI maps the face of the source images and generates a 3D face model based on the photos it is fed. The model maps out the features and then when fed a source video, it will map it over.”

See Deepfakes in Action: The Best (And Scariest) Examples Of AI-Enabled Deepfakes (Forbes)

What are the risks?

Recently, deepfakes have been used to spread hoaxes and other types of misinformation by recreating the likeness of popular opinion leaders and celebrities. Now, there’s a very real concern that they could be used to commit fraud in the form of duping the remote verification technology that helps to make our lives so convenient. This could result in sensitive information (such as bank account details, for example) being compromised without institutions even realizing that the customer whose identity they verified was not the customer at all.

It is important to note that this possibility is purely hypothetical, as no clear evidence has been found that indicates such incidents have occurred. Verifying the identity of a customer usually involves more than a single step. However, the FBI warns that it is only a matter of time before we start seeing these types of attacks emerge in the very near future.

So, if video verification deepfakes are inevitable, what can you do to counter them?

Blue Layer Protection and Training

Blue Layer lives on the frontlines of cyber defense, and we’re constantly on a vigilant lookout for innovation, both advantageous and malicious. We deploy the latest tools necessary for defending you, no matter how sophisticated the threats you’re facing might have become.

We make sure that those tools are put into the hands of those most qualified to deploy them by providing cybersecurity awareness training for your employees that updates as the industry does. Want to know what your employees need to know to look out for as deepfakes start to roll out into the world more frequently? The last thing we want is for you to be behind.

Click here to learn how Blue Layer can protect your business.

The evolution of technology has brought us many incredible things since those days. However, it’s also created a reality in which one-factor authentication can’t stand up to the threat that cybercrime poses.

Enter: multi-factor authentication, or MFA, for short.

What is MFA and how does it work?

Simply put, multi-factor authentication is a way that systems use multiple methods of making sure that you are who you say you are. Think of it as presenting two different forms of ID when filling out some type of application. This helps the organization confirm your identity by requiring you to supply something that only you know or possess.

• With something you know like a password or a PIN.
• With something physical like a USB token.
• With something physically unique to you, like your fingerprint or retina scan.
• Some combination of all three.

When you need more than one method, that’s multi-factor authentication.

Why is MFA important?

MFA is a way to enhance a company’s security by making it more difficult for cybercriminals to gain access to locked information. When a password is all that’s required, and that password is compromised, their entry is granted. When more than one unique credential is required, however, it becomes much more difficult for cybercriminals to sidestep the security measures in place.

One example that many might be familiar with is phone or email MFA. After correctly entering your password, you will be prompted to decide between a unique code to be sent to your phone number or email on file. If you are the sole owner of that phone number or email address, then only you can receive that unique code, creating a wall between your information and cybercriminals that is much harder to penetrate.

How can MFA be hacked?

In recent years, many large companies like Facebook, Google, and Twitter have adopted MFA, confirming its overall effectiveness. However, it is important to note that no MFA tool is totally and completely impenetrable.

A few different ways that hackers can penetrate multi-factor authentication include, but are not limited to, the following:

• Social engineering attacks, such as email phishing
• Technical manipulation, such as SIM swaps, “man-in-the-middle” attacks, or “man-in-the-endpoint” attacks
• Theft of your fingerprints, passwords, and other physical keys
• A combination of all three

An unfortunate reality that we all must face is that creativity and ingenuity are not lost on cybercriminals. The fortunate reality is, however, that it’s not lost on us, either.

How can I utilize MFA to protect my business?

There are many different facets to cybersecurity and cybersecurity awareness training, and MFA is one of the most important. 

Click here to get in touch with our team if you are interested in learning more about multi-factor authentication and how to integrate it into your team’s cybersecurity awareness training.