Spear Phishing Bulletin

Financially Focused Spear Phishing 

Spear phishing is a targeted form of phishing in which threat actors focus on specific individuals, organizations, or companies to obtain sensitive information. These attacks commonly rely on social engineering techniques to manipulate users into revealing confidential data or granting unauthorized access.

Since September 2019, the California Cybersecurity Integration Center (Cal-CSIC) has documented multiple spear phishing incidents associated with fraudulent financial activity. Threat actors use a variety of financially motivated tactics, including ransomware, ATM fraud, card skimming, and other cyber-enabled financial crimes.

For additional information on phishing tactics and prevention, visit the Anti-Phishing resource page.

Tactics used by Threat Actors 

• Actors open "fake" email accounts using Google, ProtonMail, Yandex, iCloud, etc. 
• The actors will create a fake email using fake or captured information requesting an urgent change in payroll information or allotment information.
• The emails sent by these actors will contain several grammatical errors indicating their illegitimacy as real emails. 

Examples are shown below:

• Copies of blank checks will have incorrect character typeset ex. different font, bolded text, name placement, and malformed checked number.

• Direct Deposit or change request lacks information such as social security number or financial institution address.

Spear Phishing Vs. Phishing

Spear Phishing can be confused with phishing; however, the main difference between the two are the targets. Phishing targets masses of people in the hopes that someone will share their information, while spear phishing targets certain people and organizations. The threat actor will send emails based on the interests of the person they are trying to phish. Due to spear-phishing targeting a certain person, the emails they send might be difficult to identify.  

How To Minimize Risk for Spear Phishing 

• Ensure the sender's name and email are correct (hover the mouse over an email address to view the actual sender's address).
• Review email for grammatical errors.
• Review financial institution information for completeness and correctness.
• Review personally identifiable information such as SSN and review signature against current records. 
• If the phishing email is from someone you know check with them to validate the email (Phone call or in person).

Actions You Can Take

• Do NOT respond to a questionable sender. 
• Immediately report suspicious requests to your Information Security Officer.
• Report the incident to abuse@csun.edu (Foward original email as an attachment)