Cyber risks in the holiday season

The holiday season brings not only a peaceful and festive atmosphere, but also increased cyber risks. Experience has shown that the number of cyber-attacks increases in the days around Christmas and New Year: On the one hand, security teams are often not fully staffed – a well-known circumstance that attackers like to take advantage of. On the other hand, seasonal stress and busy schedules reduce attention and increase vulnerability to cyber threats.

Frequent cyber threats during the holiday season

Malware emails and phishing/smishing

Fraudulent emails or SMS messages are often disguised as delivery or billing notifications to access personal data or place malware. Recipients are prompted to click links or open file attachments for more information or to track an alleged delivery. They are often led to fake websites or tricked into downloading malicious files. The main purpose of these phishing messages is to steal personal information such as passwords, credit card information or login information. In some cases, criminals also try to install malicious software such as ransomware or spyware on the victim’s devices.

Phishing messages can come via email, SMS or messenger, but also via phone or voicemail. Also due to the widespread use of AI, phishing attempts are becoming increasingly difficult to detect. In addition to technical solutions, a healthy level of mistrust is required. Verify the authenticity of the notifications by checking directly with the purported sender of the message.

Fake websites and fake shops

Fake shops and phishing websites often imitate the design, logo and even URL of well-known brands or companies. They use similar spelling or slightly modified domain names to create the appearance of authenticity. This makes potential victims safe and lures them into revealing personal information or conducting transactions. Check reviews, check the URL for spelling mistakes, and use only secure payment methods to protect yourself from fraud.

Fake ads via websites, email or social media

Fake advertising lures users with supposed special offers or discounts to entice them to reveal their information. They often promise unrealistic special offers, massive discounts or exclusive deals to attract the attention of potential victims. These fake ads can appear not only on websites, but also in emails and on social media platforms such as Facebook, Instagram or Twitter. They may be disguised as sponsored posts or ads. Do not click on offers that are too good to be true, always check the URL and against them, if necessary, manually into your browser!

Fake Charity campaigns

Fraudsters take advantage of the generosity of the people by launching bogus calls for donations to supposedly charitable causes. To increase their credibility, these fraudulent campaigns often use touching stories, fake pictures or videos that target emotional responses. Often, a supposed emergency is suggested in order to encourage people to make quick donations.

Beware, these fake charity campaigns use names or logos of legitimate charities to pretend to be serious. Official websites or contact details of organizations should be listed and comprehensible before a transaction takes place.

CEO Fraud

In CEO fraud, the fraudsters pose as high-ranking executives or CEOs. They send fake e-mails to employees who allegedly come from the management. In these, employees are asked to perform certain actions, such as paying bills, transferring money or disclosing confidential information.
Sometimes fake emails or messages can be detected by unusual grammatical errors, unexpected requests for sensitive information, or atypical behavior of the purported sender. In addition, companies should implement policies to validate transactions and protect sensitive information.

Prevention and defence measures

The most common types of attacks include phishing, ransomware, and SQL injections. The consequences may be more far-reaching during holiday periods or outside regular working hours if attacks are detected late and can spread in the network. In the event of data theft, there is also a risk of a loss of company image and trust.

Awareness campaigns:

Since many attacks start with social engineering, measures to raise awareness among all employees are particularly important. Raise security awareness and provide practical examples of possible attack scenarios. This also applies to private users:

• Be careful when clicking on links, downloading, and opening files!
• Check emails and messages for phishing attempts.
• Use strong passwords or authentication methods.
• Enable multi-factor authentication wherever possible.

Fake Shop Detector:

You can also use tools like the Fake Shop Detector as a browser add-on or check the URL of the website. Using trained AI, the code is examined and evaluated for features and their interactions to identify fraudulent websites and make shopping more secure.

Updates and backups:

Rapid deployment of available updates and – if necessary – security patches prevent exploitation of known vulnerabilities. Regular backups that are kept offline and test runs help minimize data loss in the event of an attack. Make sure that all systems are up to date before the holiday season!

Incident Response Plan:

A predefined IR plan for companies to respond appropriately and quickly to security incidents. This may include, in addition to specific instructions for action, the involvement of experts.

Permissions and Zero Trust Architecture:

Access rights should be granted on a Least Privilege basis and should be strictly controlled. If necessary, access possibilities should be minimized to limit possible damage. Deactivate unwanted remote accesses and critical accounts during the holiday period!

This might also interest you:

Strengthen cyber defences and incident response for the holidays

4 tips to boost cyber security awareness in the company

7 typical dangers when shopping online