Phishing

A type of cyberattack that involves tricking individuals into revealing sensitive information, such as login credentials, financial details, or personal data, by posing as a legitimate and trustworthy entity.

The term "phishing" is derived from the word "fishing," as attackers "fish" for victims by using deceptive tactics to lure them into divulging confidential information.

Phishing attacks commonly occur through various communication channels, including email, instant messaging, social media, text messages, or even phone calls. Attackers exploit human psychology, social engineering, and technical manipulation to create a false sense of legitimacy and urgency, leading victims to take actions that compromise their security.

Typical attributes of a phishing attack:

Deceptive Communication: Attackers craft messages that appear to come from reputable sources, such as banks, social media platforms, e-commerce websites, or government agencies (in our case mostly the Masaryk University). These messages may use official logos, branding, and language to deceive recipients.
Urgent or Tempting Content: Phishing messages often create a sense of urgency or offer enticing benefits to prompt recipients to take immediate action. Common tactics include claiming there's a security issue with the victim's account, offering a prize or discount, or warning of dire consequences if action is not taken. Phishing attacks on MU often include messages about a necessary change of credentials, work or salary related info.
Malicious Links or Attachments: Phishing emails typically contain links to fake websites that closely resemble legitimate ones. These fake websites are designed to collect sensitive information when victims unknowingly enter their credentials. Alternatively, attachments may contain malware that infects the victim's device upon opening.
Data Collection: When victims click on links and enter their information on fake websites, attackers capture the provided details, such as usernames, passwords, credit card numbers, and other personal data.
Exploitation: Attackers use the collected information for various malicious purposes, such as stealing money from bank accounts, conducting identity theft, or launching further cyberattacks. In our case, it’s mostly used for spreading spam and scam mails from trustworthy looking email addresses (within the MU domain). Attackers could potentially also reach our users' information about their salary or meddle with users' study plans in the IS.