Table of Contents
Introduction
A Pune-based real estate developer recently lost Rs 4 crore due to a whale phishing scam. Impersonating the company’s chairperson and managing director, scammers deceived the senior accounts officer into transferring funds from the company’s account to theirs over a week. Let’s Know about the whale phishing scam.
Whale Phishing Scam
A Whale Phishing Scam, also known as “whaling,” is a phishing attack that targets high-profile individuals within an organization, such as executives, senior managers, or individuals with access to sensitive information or financial assets. Unlike traditional phishing attacks that target a broader audience, whaling attacks focus on individuals with significant authority or access, aiming to steal valuable information, compromise accounts, or perpetrate financial fraud.
Why Name “Whale”?
These scams are called “whale phishing” because, just like whales are large and valuable catches, these targets hold significant power and access to crucial resources, making them highly desirable for cybercriminals.
How does it work
Whale phishing relies on social engineering tactics, manipulating the victim’s trust and sense of urgency.
- They research their target’s background, interests, and professional relationships to personalize the attack.
- They pose as familiar figures like CEOs, board members, business partners, or even close friends or family.
- The message appears urgent, legitimate, and tailored to the victim’s specific concerns. They may use pressure tactics, fake documents, or fabricated scenarios to create a sense of urgency and compliance.
- They might leverage recent events, news, or internal issues within the target’s organization to make the scam more believable.
Whaling emails are more sophisticated than generic phishing emails as they often target chief (‘c-level’) executives and usually:
- contain personalized information about the targeted organization or individual
- convey a sense of urgency
- are crafted with a solid understanding of business language and tone
Whaling email with a phone call
The NCSC is aware of several incidents whereby a whaling email was received and then followed up with a phone call confirming the email request. This is a social engineering tactic that could be described as cyber-enabled fraud. The phone call serves the dual purpose of corroborating the email request and making the victim complacent about a possible cyber attack as they have also had a ‘real world’ interaction.
Whaling emails from malicious actors masquerading as a trusted partner
The rise of supply chain attacks (where a supplier or partner organization’s network is compromised to gain access to the target organization) has been well documented. However, recent whaling attacks have used easily accessible information on suppliers or partners to construct whaling emails that appear credible. If an organization advertises partners such as charities, law firms, think tanks, or academic institutions, they should be aware that they may receive emails from malicious actors masquerading as those trusted partners.
Whaling through social media
Online social networking is an increasingly prevalent way of developing business contacts, recruiting employees, and hosting discussions. However social media accounts, both professional and personal, provide a means for malicious actors to research and make contact with senior executives. They provide a goldmine of information for social engineering, and victims are often less vigilant to attack in a more social forum.
Also, Read What Is Pink WhatsApp Scam?
Conclusion
Whaling is a means of social engineering, and malicious actors will use methods exploiting established trust structures, existing outside the cyber realm, to reassure the victim. Making your employees aware of social engineering threats doesn’t make them invulnerable; some attacks are too well crafted and no amount of user awareness and training can guarantee their detection. Employee and executive training on social engineering tactics should be considered part of a series of technical and user-based defenses against attacks, but recognize the limitations of such measures
Also, Read the 2024 Geek Squad E-mail scam