# Cybersecurity Awareness Training Module 1: Phishing and Email Security

Phishing Attacks: The Biggest Threat to Your Organization

Today, more than 90 percent of cyberattacks begin with a phishing email. The human factor, considered the weakest link in the corporate cybersecurity chain, has become the primary target of attackers. In this first module of the training series prepared by Nordis Global, we will cover in detail how to recognize phishing attacks, ensure email security, and protect your organization from these threats.

Phishing is a social engineering attack carried out by cybercriminals to deceive users and obtain their sensitive information. These attacks are executed through fake emails, messages, or websites that impersonate trusted organizations or individuals. A single click by an employee can compromise the security of the entire corporate network, which is why awareness of email security is critically important.

Types and Characteristics of Phishing Attacks

1. Traditional Phishing (Spam Phishing)

The most common type of phishing, traditional phishing consists of standard fake emails sent to randomly selected large audiences. In this method, attackers impersonate banks, e-commerce platforms, or popular service providers to redirect users to fake websites. These emails typically create a sense of urgency to push users to act without thinking.

2. Spear Phishing (Targeted Attacks)

Spear phishing is personalized phishing attacks specifically prepared for particular individuals or organizations. Attackers use information collected about the target from social media and other sources to create highly convincing messages. These attacks are much more dangerous than general phishing attacks because the recipient loses trust, believing the message was specially prepared for them.

3. Whaling (Executive-Level Targeted Attacks)

Whaling is a specialized version of spear phishing that targets senior executives, CEOs, or financial officers. These attacks typically come in the form of legitimate-looking business requests, court summons, or tax notifications. A successful whaling attack can be extremely costly for an organization and typically leads to major financial losses.

4. Clone Phishing (Cloning Attacks)

In clone phishing, attackers copy a previously sent legitimate email and replace the links or attachments within it with malicious ones. The recipient may trust this message because they received a similar email before and may click on the dangerous link.

5. Vishing (Voice Phishing) and Smishing (SMS Phishing)

Vishing is phishing attacks conducted through phone calls, while smishing is carried out via SMS messages. In these methods, attackers pose as bank employees, technical support personnel, or government officials to request sensitive information from victims.

How Can You Identify Fake Emails?

There are critical clues you need to watch for to detect phishing emails. Recognizing these signs forms your first line of defense against cyberattacks.

Sender Address Verification

Carefully examine the email address. In phishing emails, the sender address may generally appear legitimate, but upon close inspection contains small differences. For example, instead of "[email protected]," similar addresses like "[email protected]" or "[email protected]" may be used. Some attackers impersonate domain names using visually similar characters (for example, using lowercase "l" instead of uppercase "I").

Content and Language Characteristics

Frequently encountered characteristics in phishing emails include:

• Creating urgency and fear: Phrases like "Your account will be closed within 24 hours," "Suspicious activity detected"
• Spelling and grammar errors: Professional organizations generally send error-free messages
• Generic greetings: Not being addressed by your name instead of "Dear Customer"
• Suspicious requests: Requests for sensitive information such as passwords, credit card details, or ID numbers
• Offers too good to be true: Unexpected prizes, gifts, or winnings

Link and Attachment Verification

You can see the actual URL address by hovering your mouse cursor over links in emails without clicking. Even if the link text says "www.mybank.com," the actual URL may be completely different. You should also be extremely careful with attachments. Files with .exe, .zip, .scr extensions or Office documents containing macros can be particularly dangerous.

Real Phishing Examples and Analysis

Example 1: Fake Bank Notification

Attackers frequently send emails impersonating banks. A typical example: "Dear Customer, suspicious activity has been detected in your account. For your security, please click the link below to verify your information. If you do not complete the process within 24 hours, your account will be suspended."

This example contains multiple warning signs: creating urgency, generic address, request to click a link, and account closure threat. Banks never request sensitive information from customers via email.

Example 2: IT Department Impersonation

A common type of phishing in corporate environments is emails impersonating the IT department: "IT Department: Due to a system update, all employees need to renew their passwords. Complete the update process by entering your information in the attached form."

IT departments never request passwords via email. When you have suspicions, you should verify by calling the person who sent the email through known communication channels.

Example 3: Fake Shipping Notification

With the proliferation of e-commerce