Urgent Text from the CEO? Think Twice Before Responding

Imagine this: You’ve just started a new job at a new company when you get a text message that says it's from the CEO. They are requesting that you take care of a time-sensitive task. 

At first, you may think it’s a real request, but it’s more likely a pernicious form of SMS phishing known as executive impersonation, or CEO fraud. As we continue to rely on mobile devices for work, attackers are getting smarter about how they exploit our trust in these devices against us. They often monitor social media platforms like LinkedIn to identify changes at an organization, and then leverage that information to craft convincing messages. 

In this case, the attacker knows that a new employee likely doesn’t have the CEO’s phone number saved, and the lack of familiarity combined with the power imbalance creates a sense of urgency that can lead to rash decisions. The stakes are high — an unsuspecting employee may be tricked into making a financial transaction, like wiring money or purchasing gift cards, or they may even provide sensitive data such as login credentials or payroll information. 

As mobile phishing threats become increasingly sophisticated, organizations must implement stronger safeguards to protect their users and sensitive data from these deceptive attacks.

How smishing attacks target your organization – and why they fly under the radar 

Mobile devices have become indispensable to enterprise productivity. Whether through text or messaging apps, they’re critical for connecting with coworkers — and they also frequently serve as the second factor in multi-factor authentication (MFA). 

But this reliance on mobile technology has opened the door to the growing threat of smishing. Just one employee falling for a smishing attack can expose your entire organization to significant risks. Attackers often use deceptive messages that impersonate executives to trick employees into revealing corporate information, like login credentials or other sensitive data. 

Smishing and executive impersonation exploit the trust we place in SMS messages, making it one of the most effective tactics for social engineering attacks. And unfortunately, IT and security teams often lack visibility into these mobile threats, leaving them unable to implement effective prevention techniques. Without the knowledge that an attack is happening in the first place, how is it possible to continuously evolve your security strategy or get an alert out to your organization? The gap in protection and visibility — and the time it takes to learn of an attack — leaves organizations at high risk of compromise. 

As the mobile threat landscape evolves, organizations must enhance their defenses against smishing — and that starts with having the right security solutions in place.

‍

Introducing Lookout Smishing and Executive Impersonation Protection

We’re excited to announce our latest evolution in mobile security: Lookout Smishing and Executive Impersonation Protection for iOS and Android. This provides an additional layer of security for any organization and represents Lookout’s continued innovation and leadership in the mobile threat defense market. 

With new proactive protections, Lookout safeguards your organization against social engineering and executive impersonation attacks, flagging suspicious messages before your employees even interact with them. This early warning system drastically reduces the chances of successful attacks, allowing your team to focus on their work without the constant worry of falling victim to social engineering scams.

Previous solutions could not detect executive impersonation or CEO fraud attacks that didn’t contain URLs to signify malicious intent, but Lookout provides a critical layer of visibility and protection against these threats. By blocking threats up front and equipping admins with the tools to identify patterns of attacks, we significantly cut down the window of opportunity for attackers.

‍

‍

With comprehensive reporting features, administrators can gain a clear understanding of when coordinated attacks are targeting their organization. This means that security teams can implement necessary precautions and communicate proactively with employees, minimizing the risk of someone becoming a victim.

With robust protections available across both iOS and Android devices, Lookout Mobile Endpoint Security is your go-to solution for navigating the complexities of modern mobile threats like executive impersonation. 

If you’re ready to enhance your organization’s defenses against smishing and safeguard your team, check out Lookout’s free SMS Phishing Assessment.