The number and type of malicious online attacks seems to be increasing daily. Whaling/Whale Phishing is another in a long line of scams, this time leveraging and targeting senior executives. The term “whaling” was coined because of the magnitude of the targets and attacks relative to those of typical phishing ploys.
What Is Whaling Phishing?
A whaling attack, also referred to as whaling phishing, is a specific form of phishing attack that explicitly targets high-profile employees—CEOs, CFOs, or other executives (known as whales)—in order to steal sensitive information from a company. Executives/Whales can be either the target recipient or the spoofed origin of the phishing emails. Whales are carefully chosen due to their overall authority and access to secure company information. The goal of a whaling attack is to con the executive or employee into exposing corporate credentials, customer information or sending money via wire transfer.
How Do Whaling Attacks Work?
Whaling attacks work on the trust of executives and employees. When spammers impersonate an executive, an employee is unlikely to look deeper into the origin of the email and simply comply with the request. When spammers target an executive as the victim, the goal is to get access to the power of that executive: credentials, authorization of funds, even confidential information that only the executive can access.
Whaling attack emails and websites are highly customized and personalized, and they often incorporate the target’s name, job title, or other relevant information collected from a variety of sources. Due to this level of personalization and their highly targeted nature, whaling attacks are usually more difficult to detect than standard phishing attacks. Whaling phishing attacks rely on the same social engineering methods that traditional phishing uses, but in this highly targeted approach. Attackers will send hyperlinks or attachments to infect their victims with malware or to solicit sensitive information. By targeting high-value victims, fraudsters might also persuade them to approve fraudulent wire transfers using business email compromise techniques. In some cases, the attacker impersonates the CEO or other corporate officers to convince employees to carry out damaging financial transfers.
Examples of Whaling Attacks
Perhaps the most notable whaling phishing attack occurred in 2016 when a high-ranking Snapchat employee received an email from a fraudster impersonating the company’s CEO. The employee was duped into giving the attacker confidential employee payroll information. The FBI subsequently investigated the attack.1
Another newsworthy whaling scam from 2016 involved a Seagate employee who unknowingly emailed the income tax data of several current and former company employees to an unauthorized third party. After reporting the phishing scam to the IRS and FBI, it was announced that thousands of peoples’ personal data was exposed in that whaling attack.2
How do you protect yourself?
Whaling phishing uses the same entry methods as traditional phishing methods: email, malware infected links and attachments, believable email addresses and well-replicated branding and logos. To protect yourself from whaling, you need to be vigilant with every email and mindful of the financial or privacy implications of any response, even to your CEO. We recommend improving both your information security awareness training and internal policies regarding financial and privacy data handling. For example, add a corporate policy to require verbal authorizations in addition to the original email for financial or privacy transactions. Many companies operate at break-neck speed, to protect your business, you often need to slow down and think through the implications of acting upon every emails.
As a corporate inbox provider, keeping up your incoming spam and malware filtering will help reduce the flow of potentially dangerous email, but it cannot prevent it. Setting up your inbound email services so that they provide DMARC reports on email received to the original senders. This information is invaluable to combating incoming spam and phishing attempts. Also, ensure your that your inbound email services support senders restrictive DMARC policies (Quarantine or Reject) and process non-DMARC compliant email appropriately. Rejecting email that is not DMARC compliant will greatly reduce the amount of spam and phishing attempts that arrive in your inboxes.
How do you protect your brand from being used in Whaling?
The trust your partners, vendors, and customers place in your email is directly related to the value of your email and the amount of spam, malware and phishing attacks that appear to come from your domain. You cannot prevent fraudsters from creating spam and impersonating your domain, but, you can stop the spam and phishing from affecting your reputation. To shutdown phishing that appears to come from your domain, you need to adopt DMARC for your outbound email and manage your DMARC compliance rate for outbound email. Once your legitimate email is compatible, you can start instructing inbox providers to quarantine or reject non-compliant email. At that point, the majority of non-compliant email should be spam and phishing attempts using your brand. Managing your email is not a set it and forget it strategy, but an on-going process that requires regular monitoring and update.
MxToolbox’s Delivery Center
MxToolbox Delivery Center provides you with everything you need to setup, monitor and manage your DMARC compliance. Email deliverability requires constant monitoring and tuning and MxToolbox has over 10 years experience working with companies large and small to improve email delivery. Delivery Center gives you insight into Who is sending email on behalf of your domain, How Much of your email is DMARC compliant, Where email threats are coming from, How to improve your email configuration and When to make your DMARC policies more restrictive to prevent phishing using your domain.
1 https://www.scmagazineuk.com/snapchat-whaled-employee-payroll-released/article/1478171
2 https://krebsonsecurity.com/2016/03/seagate-phish-exposes-all-employee-w-2s/