Just like spear phishing attacks, phone-based scams are very much a threat to your organisation that prey on your team’s trust, and can be just as common.
Scammers that utilise this attack vector operate by posing as trusted companies (Microsoft, Google, etc.), then doing their best to convince users to provide unchecked access to your environment.
Jim Browning, a content creator who focuses on increasing awareness into online scams, recently provided an inside look into these scam centres by infecting one such scammer’s machine with malware that afforded him complete access to their operation.
In his video report, it showed how the scammers would convince victims they were a legitimate Microsoft support representative, then gain access to their machines and further convince users to transfer funds to the scamming group.
This particular case may have been simply collecting money from users, but such an operation could easily be expanded to target businesses and hold data at ransom or perform other malicious attacks.
For example, if a team member is deceived by a scammer and provides them remote access to your environment, they would have free reign to infect machines, or perform other malicious tasks that may be difficult to accomplish via email phishing or other means of attack.
If the team member has administrator access to their or other machines, the attack could be even more devastating.
Much like with other attacks, the usual pillars of environment security remain:
- Ensure users are aware such attacks can take place
- Ensure access rights given to users are befitting of their role
- Make sure all users understand who your IT support provider is and are extremely critical of allowing any others access to their machines remotely
For a comprehensive review of your systems and security practices to ensure they are safeguarded against such attacks, please get in touch with the Altitude Innovations Team.
