Using social engineering skills and of course other hacking skills, threat actors send legitimate-looking emails, impersonated domains or create completely cloned websites to create traps for organizations. In able to thwart these actions, you should know what the difference between these types of cybercrimes is.

1. Impersonating
T y p e s o f
This cybercrime mainly targets individuals of
an organization.
Whailing
Spear Phishing
www.socradar.io
The hacker sends a personalized email containing a malicious downloadable file
or a link to a malicious site, making it look like a legitimate email by
impersonating another individual, and hoping the receiver will fall prey to it.
A form of spear-phishing with a more
specific target - only the high-rank
executives of an organization.
a.k.a CEO Fraud
vishing is a technique for stealing sensitive
information through calls using Internet
Telephone Service
Smishing
Vishing
Smishing is an impersonating technique where
personal information is stolen through text or
SMS messages. There’s usually a legitimate-
looking link in the SMS which when opened
gathers your information.
This is a fake website, somehow managed to
get indexed by a search engine.
Typosquatting
Search Engine Phishing
A very well-known form to lure people into giving away their sensitive
information is by creating an online shopping website, offering very cheap or
completely free products, and asking for bank or credit card information to
proceed with shipping payment.
The squatted domain usually has a missing or an extra letter, or even a simple
misspelling, so it is not a problem to register it. If the legitimate domain is
example[.]com the domain squatter can use exarnpel.com, examplle.com,
exampl.com, and so on
A typosquatting domain is a registered
domain of a trademarked business name
with a typo in it.
Here the threat threat actor uses the brand
name, but with a different top-level domain
(TLD - .com .org .net and so on)
Top-Level Domain Squatting
Another option is purchasing a different country code TLD (ccTLD) that the
company isn’t currently using
An example of abusing a compromised VIP account is using it to send emails
to other employees, and get personal information from them, to further post
them on the dark web.