A Toolkit for Security Awareness Training Against Targeted Phishing

Abstract

The attack landscape is evolving, and attackers are employing new techniques to launch increasingly targeted and sophisticated social engineering attacks that exploit human vulnerabilities. Many organizations provide their employees with security awareness training to counter and mitigate such threats. However, recent studies have shown that current embedded phishing training programs and tools are often ineffective or incapable of addressing modern, tailored social engineering attacks. This paper presents a toolkit for the deployment of sophisticated, tailored phishing campaigns at scale (e.g., to deploy specific training within an organization). We enable the use of highly customizable phishing email templates that can be instantiated with a large range of information about the specific target and a semi-automated process for the selection of the phishing domain name. We demonstrate our tool by showing how tailored phishing campaigns proposed in previous studies can be enhanced to increase the credibility of the phishing email, effectively addressing the very limitations identified in those studies.

A Phishing Email Templates

1.1 A.1 Liking and Security Template

The Liking and Security template aims to exploit the liking principle by letting the target believe that the email sender is someone like the victim. Figure 8a presents the template proposed by Olivera et al. [18] for their experiment and Fig. 8b shows how the template can be enhanced to exploit target information. In particular, we have enhanced the template in [18] to strengthen the liking weapon and to avoid possible mismatches between the spelling used in the email and the one typically used by the target, which may raise suspicion in the target.

Fig. 8.

Liking and Security template and our modification

Table 6. Target fields in the Liking and Security template

To emulate the spelling typically used by the victim, we use target field american-spelling to determine, for instance, from the country of the target and from previous communications that the target had, whether he usually communicates in American English or not, and, based on this field, customize the email using the proper spelling (e.g., neighbor vs. neighbour). We also use variable fake-name to choose a name for the email sender that reflects the gender of the target, as it has been shown that people are more inclined to respond to persons of the same gender [6]. If the gender of the victim is unknown, a gender-neutral name is used for the sender (default option in Table 7). Other target fields (Table 6) and variables (Table 7) are used to customize the email based on information about the target. For instance, variable break-into and incident-event are used to customize the pretext based on the target field own.

Table 7. Variables & Conditions for the Liking and Security template

1.2 A.2 Reciprocation and Social Template

The Reciprocation and Social template aims to trigger a reciprocation feeling in the target by promising to donate a given amount of money to promote a particular product. Figure 9a presents the template proposed by Olivera et al. [18] for their experiment and Fig. 9b shows how the template can be enhanced to exploit target information. As for the Commitment and Ideological template (Fig. 7), the pretext and relative variables (see Table 9) are instantiated based on the interest (see Table 8) of the target (which objects he is interested in), so that he is more inclined to click the link in order to know more details. In particular, award is the amount of money donated to the target, obj-bought is what he can buy with that donation, donated-by is the organization who provided the award, org-claim is the purpose of the organization and award-application describes the shops where the target can use the donation, based on the product promoted. This way, the email template is instantiated automatically based on the value of target field interest. Additional target information (address, email, region in Table 8) are used to increase the credibility of the generated phishing email.

Fig. 9.

Template Reciprocation and Social and our modification

Table 8. Target fields in the Reciprocation and Social template

Table 9. Variables & Conditions for the Reciprocation and Social template