Threat Intelligence

General

Social engineering, a manipulation tactic, has seen a 60% increase in attacks over the past year, resulting in estimated losses exceeding $1.5 billion in the online gambling industry alone. Attackers exploit human psychology, posing a significant threat to user data and system security.

Here are some examples of how social engineering may be used in the online gambling industry:

• Fake websites or emails mimicking legitimate platforms (such as Office365, Google, etc.) are created to trick users into providing their login credentials or financial information.
•  Attackers may pose as customer support agents through emails or messages, claiming issues with the user’s account and requesting sensitive information.
• Fraudsters may create fake promotions or bonuses, enticing users to click on malicious links or provide personal details under the guise of claiming rewards.
• Manipulating individuals into revealing personal information can lead to unauthorised access to user accounts, enabling attackers to make unauthorised transactions.
• Attackers may send deceptive payment requests, claiming users need to update their payment details or transfer funds to resolve a fabricated issue.

Scope

Our Social Engineering Assessments primarily use phishing emails, the most common form of attacks in the online gambling industry. We assess an organisation’s vulnerability, security awareness, and preventive measures.

Process

The process involves stages such as information gathering, campaign tailoring, phishing email creation, landing page design, user interaction monitoring, and comprehensive reporting:

• Information Gathering:  Employ public sources to harvest email addresses and domain information related to the target organisation.
• Campaign Tailoring:  Analyse collected data to tailor a phishing campaign specific to the targeted domain, ensuring relevance and believability.
• Phishing Email Creation: Develop a phishing email containing elements such as a tracking image and enticing links to simulate real-world scenarios.
• Landing Page Design: Create a custom landing website that replicates scenarios like a payment request or a password change prompt, without actually requesting sensitive information.
• User Interaction Monitoring:  Launch the ethical phishing campaign and monitor user interactions, tracking metrics like email opens, link clicks, and entered email addresses.
• Reporting: Generate a detailed report summarising the campaign, including statistics on user engagement, to help the organisation understand vulnerabilities and improve security measures.

Benefits

Social engineering attacks manifest as dispersed or directed, exploiting trust to cause harm. Our experts, equipped to handle phishing, pretexting, baiting, or quid pro quo, offer tailored preventive strategies. Partner with us to navigate the complexities of social engineering threats with confidence and expertise.