Comparative Simulation of Phishing Attacks on a Critical Information Infrastructure Organization: An Empirical Study

• URL: http://arxiv.org/abs/2410.20728v1
• Date: Mon, 07 Oct 2024 06:55:44 GMT
• Title: Comparative Simulation of Phishing Attacks on a Critical Information Infrastructure Organization: An Empirical Study
• Abstract summary: In the first attempt, workers of a Thai railway firm received a phony email purporting to inform recipients of a special deal from a reputable retailer of IT equipment. The findings showed that 10.9% of the 735 workers fell for the scam. A further 8.0% of the workers who did not fall victim to the first attack were deceived.
• Score: 2.874893537471256
• License: http://creativecommons.org/licenses/by-sa/4.0/
• Abstract: Nowadays, cybersecurity is crucial. Therefore, cybersecurity awareness should be a concern for businesses, particularly critical infrastructure organizations. The results of this study, using simulated phishing attacks, indicate that in the first attempt, workers of a Thai railway firm received a phony email purporting to inform recipients of a special deal from a reputable retailer of IT equipment. The findings showed that 10.9% of the 735 workers fell for the scam. This demonstrates a good level of awareness regarding cyber dangers. The workers who were duped by the initial attack received awareness training. Next, a second attempt was carried out. This time, the strategy was for the workers to change their passwords through an email notification from the fake IT staff. According to the findings, 1.4% of the workers fell victim to both attacks (different email content), and a further 8.0% of the workers who did not fall victim to the first attack were deceived. Furthermore, after the statistical analysis, it was confirmed that there is a difference in the relationship between the workers and the two phishing attack simulations using different content. As a result, this study has demonstrated that different types of content can affect levels of awareness.

Related papers

• How Vulnerable Are AI Agents to Indirect Prompt Injections? Insights from a Large-Scale Public Competition [48.32744727426218]
  LLM based agents are increasingly deployed in high stakes settings where they process external data sources such as emails, documents, and code repositories.<n>This creates exposure to indirect prompt injection attacks, where adversarial instructions embedded in external content manipulate agent behavior without user awareness.<n>We present findings from a large scale public red teaming competition evaluating this dual objective across three agent settings.
  arXiv  Detail & Related papers  (2026-03-16T14:49:36Z)
• Sustaining Cyber Awareness: The Long-Term Impact of Continuous Phishing Training and Emotional Triggers [1.0399614883374282]
  Phishing constitutes more than 90% of successful cyberattacks globally.<n>This study examines how continuous cybersecurity training and emotional cues affect employee susceptibility to phishing.
  arXiv  Detail & Related papers  (2025-10-31T09:15:34Z)
• Exploring User Risk Factors and Target Groups for Phishing Victimization in Pakistan [0.0]
  Phishing attacks pose a significant cybersecurity threat globally.<n>This study investigates phishing susceptibility within the Pakistani population.<n>Men, individuals over 25, employed persons and frequent online shoppers have relatively high phishing susceptibility.
  arXiv  Detail & Related papers  (2025-10-10T10:37:18Z)
• Characterizing Phishing Pages by JavaScript Capabilities [77.64740286751834]
  This paper aims to aid researchers and analysts by automatically differentiating groups of phishing pages based on the underlying kit.<n>For kit detection, our system has an accuracy of 97% on a ground-truth dataset of 548 kit families deployed across 4,562 phishing URLs.<n>We find that UI interactivity and basic fingerprinting are universal techniques, present in 90% and 80% of the clusters.
  arXiv  Detail & Related papers  (2025-09-16T15:39:23Z)
• PiMRef: Detecting and Explaining Ever-evolving Spear Phishing Emails with Knowledge Base Invariants [15.892817656568063]
  Phishing emails are a critical component of the cybercrime kill chain due to their wide reach and low cost.<n>We propose PiMRef, the first reference-based phishing email detector that leverages knowledge-based invariants.<n>In a real-world evaluation of 10,183 emails across five university accounts over three years, PiMRef achieved 92.1% precision, 87.9% recall, and a median runtime of 0.05s.
  arXiv  Detail & Related papers  (2025-07-21T08:53:41Z)
• Anti-Phishing Training Does Not Work: A Large-Scale Empirical Assessment of Multi-Modal Training Grounded in the NIST Phish Scale [3.599344290726663]
  Phishing attacks are a critical cybersecurity threat.<n>Many organizations allocate a substantial portion of their cybersecurity budgets to phishing awareness training.<n> Empirical evidence of training (in)effectiveness is essential for evidence-based cybersecurity investment.
  arXiv  Detail & Related papers  (2025-06-24T17:57:10Z)
• The Impact of Emerging Phishing Threats: Assessing Quishing and LLM-generated Phishing Emails against Organizations [11.408506093729102]
  Two emerging vectors stand out in the current landscape: QR-code baits and LLM-enabled pretexting.<n>We conduct three phishing simulations across organizations of varying sizes.<n>Our results show that quishing emails have the same effectiveness as traditional phishing emails at luring users to the landing webpage.
  arXiv  Detail & Related papers  (2025-05-17T18:14:57Z)
• Llama-3.1-FoundationAI-SecurityLLM-Base-8B Technical Report [50.268821168513654]
  We present Foundation-Sec-8B, a cybersecurity-focused large language model (LLMs) built on the Llama 3.1 architecture. We evaluate it across both established and new cybersecurity benchmarks, showing that it matches Llama 3.1-70B and GPT-4o-mini in certain cybersecurity-specific tasks. By releasing our model to the public, we aim to accelerate progress and adoption of AI-driven tools in both public and private cybersecurity contexts.
  arXiv  Detail & Related papers  (2025-04-28T08:41:12Z)
• Efficient Backdoor Defense in Multimodal Contrastive Learning: A Token-Level Unlearning Method for Mitigating Threats [52.94388672185062]
  We propose an efficient defense mechanism against backdoor threats using a concept known as machine unlearning. This entails strategically creating a small set of poisoned samples to aid the model's rapid unlearning of backdoor vulnerabilities. In the backdoor unlearning process, we present a novel token-based portion unlearning training regime.
  arXiv  Detail & Related papers  (2024-09-29T02:55:38Z)
• Targeted Attacks: Redefining Spear Phishing and Business Email Compromise [0.17175834535889653]
  Some rare, severely damaging email threats - known as spear phishing or Business Email Compromise - have emerged. We describe targeted-attack-detection techniques as well as social-engineering methods used by fraudsters. We present text-based attacks - with textual content as malicious payload - and compare non-targeted and targeted variants.
  arXiv  Detail & Related papers  (2023-09-25T14:21:59Z)
• An Overview of Phishing Victimization: Human Factors, Training and the Role of Emotions [0.0]
  Phishing is a form of cybercrime that allows criminals, phishers, to deceive end users in order to steal their confidential and sensitive information. This paper explores the emotional factors that have been reported in previous studies to be significant in phishing victimization.
  arXiv  Detail & Related papers  (2022-09-13T12:51:20Z)
• Email Summarization to Assist Users in Phishing Identification [1.433758865948252]
  Cyber-phishing attacks are more precise, targeted, and tailored by training data to activate only in the presence of specific information or cues. This work leverages transformer-based machine learning to analyze prospective psychological triggers. We then amalgamate this information and present it to the user to allow them to (i) easily decide whether the email is "phishy" and (ii) self-learn advanced malicious patterns.
  arXiv  Detail & Related papers  (2022-03-24T23:03:46Z)
• Phishing Attacks Detection -- A Machine Learning-Based Approach [0.6445605125467573]
  Phishing attacks are one of the most common social engineering attacks targeting users emails to fraudulently steal confidential and sensitive information. In this paper, we proposed a phishing attack detection technique based on machine learning. We collected and analyzed more than 4000 phishing emails targeting the email service of the University of North Dakota.
  arXiv  Detail & Related papers  (2022-01-26T05:08:27Z)
• Textual Backdoor Attacks Can Be More Harmful via Two Simple Tricks [58.0225587881455]
  In this paper, we find two simple tricks that can make existing textual backdoor attacks much more harmful. The first trick is to add an extra training task to distinguish poisoned and clean data during the training of the victim model. The second one is to use all the clean training data rather than remove the original clean data corresponding to the poisoned data.
  arXiv  Detail & Related papers  (2021-10-15T17:58:46Z)
• Falling for Phishing: An Empirical Investigation into People's Email Response Behaviors [10.841507821036458]
  Despite sophisticated phishing email detection systems, humans continue to be tricked by phishing emails. We have carried out an empirical study to investigate people's thought processes when reading their emails. We identify eleven factors that influence people's response decisions to both phishing and legitimate emails.
  arXiv  Detail & Related papers  (2021-08-10T16:19:01Z)
• Strong Data Augmentation Sanitizes Poisoning and Backdoor Attacks Without an Accuracy Tradeoff [57.35978884015093]
  We show that strong data augmentations, such as CutMix, can significantly diminish the threat of poisoning and backdoor attacks without trading off performance. In the context of backdoors, CutMix greatly mitigates the attack while simultaneously increasing validation accuracy by 9%.
  arXiv  Detail & Related papers  (2020-11-18T20:18:50Z)
• Backdoor Attack against Speaker Verification [86.43395230456339]
  We show that it is possible to inject the hidden backdoor for infecting speaker verification models by poisoning the training data. We also demonstrate that existing backdoor attacks cannot be directly adopted in attacking speaker verification.
  arXiv  Detail & Related papers  (2020-10-22T11:10:08Z)
• Phishing and Spear Phishing: examples in Cyber Espionage and techniques to protect against them [91.3755431537592]
  Phishing attacks have become the most used technique in the online scams, initiating more than 91% of cyberattacks, from 2012 onwards. This study reviews how Phishing and Spear Phishing attacks are carried out by the phishers, through 5 steps which magnify the outcome.
  arXiv  Detail & Related papers  (2020-05-31T18:10:09Z)
• Adversarial Fooling Beyond "Flipping the Label" [54.23547006072598]
  CNNs show near human or better than human performance in many critical tasks. These attacks are potentially dangerous in real-life deployments. We present a comprehensive analysis of several important adversarial attacks over a set of distinct CNN architectures.
  arXiv  Detail & Related papers  (2020-04-27T13:21:03Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.