Phishing napadi: Kako ih prepoznati i kako zaštititi svoju organizaciju

← Blog

Zašto je phishing toliko efikasan?

Phishing ne napada tehničke sisteme — napada ljude. I 2024, prosečan phishing email ima 30% šansu da prevari bar jednog zaposlenog u organizaciji. Razlog: napadi su sve sofisticiraniji, imitiraju poznate brende i kolege, i koriste društveni inženjering (urgentnost, autoritet, strah) da isključe kritičko razmišljanje.

Vrste phishing napada

Email Phishing (masovni)

Najčešći tip: napadač šalje identičan email stotinama hiljada primalaca imitirajući banke, PayPal, Microsoft, Poštu Srbije, poresku upravu. Kvalitet varira, ali sofisticirani napadi su teško razlikovati od legitimnih emailova.

Spear Phishing

Ciljani napad na specifičnu osobu ili organizaciju. Napadač istražuje metu (LinkedIn, sajt firme, javne objave) i kreira personalizovanu poruku. "Zdravo Marko, šaljem ti fakturu od Telekoma kako smo pričali u utorak" — ovo je spear phishing.

Whaling (CEO Fraud)

Spear phishing usmeren na C-level (CEO, CFO) ili kao imitacija CEO-a prema finansijskom timu: "Hitno mi treba transfer od 50.000€ za akviziciju, ne pominj nikome."

Smishing (SMS phishing)

"Vaš paket je zadržan na carini. Platite 200 din. www.posta-srbija-carinjenje[.]com" — lažna domena koja imitira legitimni sajt.

Vishing (Voice phishing)

Telefonski pozivi koji imitiraju tehničku podršku, banku ili regulatorne organe. Sve češće koriste AI voice cloning.

Kako prepoznati phishing email

• Domen pošiljaoca: [email protected], [email protected]
• Urgentnost: "Vaš nalog će biti ugašen za 24h!" — pritisak koji isključuje razmišljanje
• Generički pozdrav: "Poštovani korisniče" umesto vašeg imena
• Sumnjiive linkove: hover mišem iznad linka — URL koji se prikazuje ne odgovara tekstu
• Nesigurni attachment: .exe, .zip, .doc sa makroima, .html koji otvara formu za logovanje
• Greške u pisanju: napadači iz van često pišu sa gramatičkim greškama

Tehničke mere zaštite

Email autentifikacija (SPF + DKIM + DMARC)

Sprečava napadače da šalju emailove koji izgledaju kao da dolaze sa vašeg domena. Bez ove konfiguracije, vaš domen može biti zloupotrebljen za phishing vaših kupaca i partnera.

Multi-Factor Authentication (MFA)

Čak i ako napadač ukrade lozinku, MFA ga sprečava od pristupa nalogu. Hardware token (YubiKey) je najotporniji; TOTP aplikacija (Authenticator) je dobar balans.

Email gateway sa anti-phishing filterima

Microsoft Defender za Office 365, Proofpoint, Mimecast — analiziraju emailove pre dostave, detektuju poznate phishing kampanje, lažne domene i maliciozne attachmente.

DMARC reporting

DMARC izveštaji vam pokazuju ko pokušava da šalje emailove u vaše ime — otkrivate phishing kampanje koje ciljaju vaše kupce koristeći vaš domen.

Edukacija zaposlenih

Tehničke mere smanjuju, ali ne eliminišu rizik. Redovni simulated phishing treninzi (npr. KnowBe4, Proofpoint SAT) merljivo smanjuju klik stopu i grade "refleks sumnje" kod zaposlenih.

← Blog

Why Is Phishing So Effective?

Phishing doesn't attack technical systems — it attacks people. In 2024, the average phishing email has a 30% chance of deceiving at least one employee in an organization. The reason: attacks are increasingly sophisticated, imitating known brands and colleagues, using social engineering (urgency, authority, fear) to bypass critical thinking.

Types of Phishing Attacks

Email Phishing (Mass)

The most common type: an attacker sends an identical email to hundreds of thousands of recipients, impersonating banks, PayPal, Microsoft, shipping carriers, or tax authorities. Quality varies, but sophisticated attacks are hard to distinguish from legitimate emails.

Spear Phishing

A targeted attack on a specific person or organization. The attacker researches the target (LinkedIn, company website, public posts) and creates a personalized message. This level of personalization is what makes spear phishing so dangerous.

Whaling (CEO Fraud)

Spear phishing targeting C-level executives (CEO, CFO) or impersonating the CEO to target the finance team: "I urgently need a €50,000 transfer for an acquisition, don't mention it to anyone."

Smishing (SMS Phishing)

"Your package is held at customs. Pay a fee at www.post-customs-release[.]com" — a fake domain impersonating a legitimate site.

How to Recognize a Phishing Email

• Sender's domain: [email protected], [email protected]
• Urgency: "Your account will be closed in 24 hours!" — pressure that shuts down thinking
• Generic greeting: "Dear valued customer" instead of your name
• Suspicious links: hover over the link — the displayed URL doesn't match the text
• Unexpected attachments: .exe, .zip, .doc with macros

Technical Protection Measures

Email Authentication (SPF + DKIM + DMARC)

Prevents attackers from sending emails that appear to come from your domain. Without this configuration, your domain can be abused to phish your customers and partners.

Multi-Factor Authentication (MFA)

Even if an attacker steals a password, MFA prevents access to the account. Hardware tokens (YubiKey) are the most resistant; TOTP apps (Authenticator) are a good balance.

Email Gateway with Anti-Phishing Filters

Microsoft Defender for Office 365, Proofpoint, Mimecast — these analyze emails before delivery, detecting known phishing campaigns, fake domains, and malicious attachments.

Employee Training

Technical measures reduce but don't eliminate risk. Regular simulated phishing training (e.g., KnowBe4, Proofpoint SAT) measurably reduces click rates and builds a "suspicion reflex" among employees.