Related
Recommended
Sophos
Protect yourself from Social Engineering Attacks

Have you experienced getting a message from someone you know asking for your password? Or did you receive an SMS with a suspicious link asking to take action immediately?  
 
Phishing is real – don't get hooked! 

Some of our customers and partners have recently reported phishing attacks to us, wherein some are trying to impersonate Sophos Support. In this blog, we want to empower the Sophos Community members to protect themselves against possible social engineering attacks.  

What is Phishing 

Phishing is a social engineering attack that tries to trick you into disclosing sensitive and confidential information or downloading malicious software onto your system.  
 
This cyberattack comes in different forms: emails, instant messages, SMS, social media apps, and pop-up notifications. Let's dive deeper into it. 

How to Identify Phishing

In a Naked Security blog post, authors Juan Badell and Russell Petrich provided examples of phishing tricks from a real cyber attacker's perspective that you should not fall for. In a nutshell, you should be reminded of these things: 

  • Cyber attackers will carefully identify their target.
  • Emotional triggers will be their weapon. 
  • Action-packed email content will make you fall into it. 
  • Email sender will contain typo errors to make it look real.  

Read the full blog to learn more: https://nakedsecurity.sophos.com/2020/12/15/phishing-tricks-that-really-work-and-how-to-avoid-them/ 

You can also ask these questions to help you identify whether you're under a social engineering attack:  

  1. Who sent the email? 
    • Check the sender's email carefully and look for any slight variations from the Sophos official domain (Sophos.com)  
    • Real: sophos.com; Sophos.com.au; Sophos.com.de 
    • Fake: 5ophos.com, sophossupport.com

  2.  What does the email header look like?
    • Check the email headers to confirm the sender's email address, as well as any Email Record (SPF, DMARC, DKIM) 

  3.  Did they send you any links?
    • Avoid clicking on suspicious links.
      • Remember: Sophos will NEVER tell you to click a link to download any software) or download attachments from unsolicited emails.  
    • Here's what to do before clicking links:  
      • Hover your mouse over the link to preview the URL 
      • Enable any Time Of Click protection software you may have
    • Submit links and files to SophosLabs through Intelix: https://intelix.sophos.com/ 

  4.  Did the email use urgent language? 
    • Always look for urgent language. More often than not, those are phishing emails.
    • Their trick is to try making it sound urgent so they can manipulate you into taking action immediately.  
    • Some examples of urgent language: 
      • "You need urgent assistance! " 
      • "Your account has been suspended"  
      • "We are closing your account by end of day... "  

  5.  Still in doubt if it's Sophos?  

Our team is ready to assist you 24/7. 

How Sophos Support would contact you vs. a social engineering attack  

These are specific examples that will help you determine how Sophos would legitimately reach out to you as our customers and partners: 

  • Consider the urgency of the Email Subject line 
  • Verify the sender's email address 
  • Read the email content carefully, and do NOT click links right away 

Report suspected phishing attacks

If you encounter any social engineering incident that involves Sophos or any of our staff members, please don't hesitate to report it to our team. Here are some ways to report it: 

  • Contact Sophos Support via Support Portal (support.sophos.com) 
  • Our Digital Chat Support Team is available 24/7 
  • Send us a DM via Sophos Support social media platforms 

Unfiltered HTML