This title slide is titled "Phishing Attacks & Cyber Awareness." It is presented by Dixit Thummar, a Cyber Security Analyst.

Phishing Attacks & Cyber Awareness

Presented by Dixit Thummar Cyber Security Analyst

Source: Presented by Dixit Thummar (Cyber Security Analyst). Animated network background, rotating shield icon, Global Threat Level meter. Cyber-themed visuals.

This agenda slide outlines a presentation on phishing, starting with understanding attacks (definitions, motivations, kill chain, types). It continues with recognizing tactics (email signs, smishing, vishing, fake sites), impacts and case studies, protection/response strategies, and key takeaways.

Introduction

1. Understanding Phishing Attacks

Definition, motivations, kill chain, and types.

2. Recognizing Phishing Tactics

Email signs, smishing, vishing, fake websites.

3. Impacts and Case Studies

Financial losses, psychology, statistics reviewed.

4. Protection and Response

Identification checklists, defenses, incident steps.

5. Key Takeaways

Summary learnings and final motto. Source: Phishing Attacks & Cyber Awareness by Dixit Thummar

Phishing is a fraudulent attempt to obtain sensitive information by masquerading as a trustworthy entity, like a bank or colleague. It exploits trust, urgency, and familiarity, and is visually depicted as an envelope with a fishing hook.

What Is Phishing?

• Phishing: Fraudulent attempt to obtain sensitive information.
• Masquerades as trustworthy entity (e.g., bank, colleague).
• Exploits trust, urgency, and familiarity.
• Visual: Envelope with a fishing hook.

Hackers favor phishing due to its low cost ($0–$100 per campaign), high scalability for targeting millions, and ease for novice attackers. It also delivers exceptional ROI while effectively bypassing technical defenses.

Why Hackers Use Phishing

• Low cost: $0–$100 per campaign
• High scalability: Millions targeted easily
• Easy entry for novice attackers
• Exceptional ROI potential
• Bypasses technical defenses effectively

Source: Phishing Attacks & Cyber Awareness

The slide presents a 5-step phishing kill chain timeline, starting with reconnaissance to gather target info via OSINT and social media. It progresses through weaponization of malicious payloads, delivery via lure emails, victim exploitation, and malware installation with attacker command-and-control.

How Phishing Works: 5-Step Kill Chain

Step 1: Reconnaissance Gather target info via OSINT, social media, company sites (5 words). Step 2: Weaponization Craft malicious payload, e.g., malware in email attachment or link (7 words). Step 3: Delivery Send phishing email with lure to trick victim into action (8 words). Step 4: Exploitation Victim interacts; exploit triggers vulnerability to run payload (5 words). Step 5: Installation & C2 Malware installs, phones home to attacker for control (6 words).

Source: Dixit Thummar (Cyber Security Analyst)

Email phishing dominates at 90% as the most common attack vector, followed by spear phishing at 65% with higher success on targets. Smishing is rising fast at 15%, while vishing attacks account for 5% via voice-based deception.

Types of Phishing

• 90%: Email Phishing

Most common attack vector.

• 65%: Spear Phishing

Higher success on targets.

• 15%: Smishing Rise

SMS phishing growing fast.

• 5%: Vishing Attacks

Voice-based deception. Source: Verizon DBIR & Cybersecurity Reports

The slide contrasts legitimate emails, which use verified domains, polite language, trusted links, and professional formatting, against phishing emails with typos in sender addresses, urgent threats, suspicious links, and demands for passwords. It highlights key signs like poor grammar and generic greetings in phishing attempts.

Email Phishing Signs

Source: Phishing Attacks & Cyber Awareness - Dixit Thummar

The slide defines Smishing as scammers sending fake SMS alerts from "banks" with malicious links, advising to contact official channels directly, ignore links, and delete suspicious texts. It describes Vishing as fraudsters calling as authorities or tech support with threats, recommending to hang up, call back official numbers, and never share info on unsolicited calls.

Smishing & Vishing

Source: Phishing Attacks & Cyber Awareness - Dixit Thummar (Cyber Security Analyst)

The slide contrasts legitimate websites—featuring exact URLs like bank.com, valid HTTPS certs with green padlocks, no browser warnings, and matching branding—with fake phishing sites using typosquatting (e.g., bannk.com). It debunks HTTPS myths, noting free certs make it unreliable, flags red warnings and hasty urgings, and advises hovering/inspecting before clicking.

Fake Websites & HTTPS Myths

| ✅ Exact URL: bank.com ✅ Green padlock: Valid HTTPS cert from trusted CA ✅ No warnings in browser ✅ Matches official branding Safe when from trusted links. | ❌ Typosquatting: bannk.com or bank-support.com ❌ Red warnings: Self-signed or invalid cert ❌ HTTPS ≠ safe (easy to get free certs) ❌ Urges hasty action Hover/inspect before clicking! |

Source: Dixit Thummar (Cyber Security Analyst)

Between 2013-2015, hackers defrauded Google and Facebook of $100M in a BEC attack by impersonating a Lithuanian bank via fake emails and invoices, resulting in 11 fraudulent wire transfers. Key lessons: independently verify wire requests, require multi-level payment approvals, and train staff on vendor verification protocols.

Case Study: Google & Facebook BEC

• BEC attack defrauded Google & Facebook of $100M (2013-2015)
• Hackers impersonated Lithuanian bank via fake emails
• Fake vendor invoices led to 11 fraudulent wires
• Lesson: Always verify wire requests independently
• Lesson: Require multi-level approvals for payments
• Lesson: Train staff on vendor verification protocols

Source: Business Email Compromise: $100M loss in 2013-2015

The slide outlines phishing's psychological tactics: fear via urgent threats, greed through quick-reward promises, and curiosity from intriguing bait. It counters these by advising to pause, verify sources, and educate yourself.

Psychology Behind Phishing

• Fear: Urgent threats trigger panic responses.
• Greed: Rewards promise quick gains.
• Curiosity: Intriguing bait sparks clicks.
• Counter: Pause, verify, educate yourself.

Source: Phishing Attacks & Cyber Awareness by Dixit Thummar

Phishing impacts individuals through identity theft and financial losses. Organizations suffer data breaches and operational downtime, while society faces erosion of trust and national security risks.

Impact of Phishing

• Individuals: Identity theft and financial losses
• Organizations: Data breaches and operational downtime
• Society: Erosion of trust and national security risks

Source: Phishing Attacks & Cyber Awareness by Dixit Thummar

The "Key Statistics" slide reports 300K new phishing sites detected daily worldwide and that 90% of cyber attacks begin with email. It also highlights $52B in global phishing economic losses for 2023.

Key Statistics

• 300K: Phishing Sites Daily

New sites detected worldwide

• 90%: Attacks Start with Email

Most cyber attacks begin here

• $52B: Global Cost 2023

Annual phishing economic losses Source: APWG, Verizon DBIR 2023

This slide, "How to Identify Phishing," outlines key tips for spotting scams. Hover over links to check destinations, verify sender emails/domains, inspect attachments, question urgent requests, and report suspicious messages immediately.

How to Identify Phishing

• Hover over links to verify destinations
• Check sender email and domain authenticity
• Inspect attachments before opening
• Question unexpected or urgent requests
• Report suspicious messages immediately

Source: Phishing Attacks & Cyber Awareness

The slide contrasts legitimate emails, which feature matching sender domains, consistent headers, professional formatting, no suspicious links/attachments, and passing SPF/DKIM/DMARC checks, with spoofed ones. Spoofed emails show faked display names, mismatched headers, urgent language, malware attachments/links, poor grammar, unexpected requests, and failed authentication.

Real vs Fake Email

Source: Dixit Thummar (Cyber Security Analyst)

The "Personal Protection" slide outlines key cybersecurity practices for individuals. It recommends enabling MFA on all accounts, regularly updating software and OS, maintaining reputable antivirus, and verifying links/attachments before clicking.

Personal Protection

• Enable Multi-Factor Authentication (MFA) on all accounts
• Regularly update software and operating systems
• Install and maintain reputable antivirus software
• Think before clicking: verify links and attachments

Source: Dixit Thummar

The "Org-Level Controls" slide outlines organizational cybersecurity measures to combat phishing and email threats. It recommends advanced email filters, DMARC implementation, regular awareness training, zero-trust principles, and layered defenses.

Org-Level Controls

• Deploy advanced email filters and spam blockers
• Implement DMARC for domain authentication
• Run regular phishing awareness training programs
• Adopt zero-trust architecture principles
• Layer defenses for robust protection

Source: Phishing Attacks & Cyber Awareness

If phished, immediately disconnect from the internet, change all affected passwords, and scan your device for malware. Report the incident to IT or police, and monitor accounts for suspicious activity.

What To Do If Phished

• Disconnect from internet immediately.
• Change all affected passwords promptly.
• Scan device for malware thoroughly.
• Report incident to IT or police.
• Monitor accounts for suspicious activity.

Source: Dixit Thummar (Cyber Security Analyst)

The slide highlights that awareness trumps technology in phishing defense, with the motto "Verify Before You Click!" It advises spotting red flags like urgency, poor grammar, and unknown senders, always verifying links and attachments, and reporting incidents swiftly.

Key Learnings

• Awareness surpasses technology in phishing defense.
• Adopt motto: 'Verify Before You Click!'
• Spot signs: urgency, poor grammar, unknown senders.
• Verify links, attachments, and websites always.
• Report incidents promptly and respond swiftly.

Source: Phishing Attacks & Cyber Awareness

The conclusion slide quotes "Cybersecurity Pro": "The best defense is vigilance," followed by a call to "Stay vigilant against phishing threats!" Its subtitle urges: "Implement awareness today—secure tomorrow."

Conclusion

'The best defense is vigilance.'

— Cybersecurity Pro

Stay vigilant against phishing threats!

Implement awareness today—secure tomorrow.

Source: Verizon DBIR, FBI IC3