Whaling is a highly targeted phishing method used by cybercriminals who masquerade as a senior executive in an organization and directly target other senior or important individuals within that organization. The aim is to steal money, access sensitive information or gain access to computer networks and systems.
How whaling attacks work
The aim of a whaling attack is to trick an individual into disclosing personal or corporate information through the use of a social engineering email. Attackers will often launch these attacks by impersonating other chief executives, trusted contacts in the supply chain, or other services used by the organization.
The emails will be highly personalized and customized, written in appropriate business language and will create a sense of urgency relating to the information requested.
By targeting high-value victims, attackers may use them to approve fraudulent monetary transfers, or even convince employees to carry out financial transfers.
How to detect a possible whaling attack
Here are a few common indicators of a possible whaling attack:
Unusual requests: Cyberattackers will research an organization to find information to construct highly sophisticated phishing emails masking as a legitimate sender. Be aware of unusual requests for information from partners or personnel within your organization.
Urgency: A whaling message will contain a sense of urgency that requires the victim to take immediate action, hoping to evoke an impulsive decision and eliminating time for verification.
Spoofed sender: It is possible to receive an email from a known or trusted sender, but the email’s sender credentials are spoofed, meaning that the sender is illegitimate. If you are receiving a message that seems out of context or unusual, always check the sender’s credentials (email address, name etc) to ensure that they are a legitimate recipient. If you are still unsure, you can always contact the sender via a different method of communication to verify the request.
How to protect against whaling
Some best practices for preventing whaling include the following:
- Employee awareness. Preventing any type of cybersecurity threat requires every employee to take responsibility for protecting the company’s assets. In the case of whaling, all employees must be trained on these attacks and what to do if they suspect they have received a whaling (or any other social engineering) email. Although high-level executives are the targets, lower-level employees could indirectly expose an executive to an attack through a security lapse.
- Data protection policies. Data security and protection policies should be in place to ensure emails and files are monitored for suspicious network activity. These policies should provide a layered defense against phishing attempts to decrease the chances of a breach occurring.
- Multistep verification. All requests for wire transfers, financial payments and access to confidential or sensitive data should pass through several levels of verification before being permitted. Check all emails and attachments from outside of the organization for malware, viruses and other issues to identify potentially malicious traffic.
