[{"data":1,"prerenderedAt":1276},["ShallowReactive",2],{"threats-nav-data-en":3,"threat-en-phishing":830,"threat-counterpart-en-phishing":1010,"threat-surround-en-phishing":1274},[4,321,563],{"id":5,"title":6,"alias":7,"body":8,"category":302,"description":303,"extension":304,"gameScenarioLink":305,"gameScenarioTitle":306,"icon":307,"meta":308,"navigation":309,"path":310,"seo":311,"severity":312,"sitemap":313,"slug":314,"stem":315,"vector":316,"__hash__":320},"threats_en\u002Fthreats\u002F01.phishing.md","Phishing (Credential Harvesting & Scams)","Email Phishing, Smishing & Deceptive Portals",{"type":9,"value":10,"toc":290},"minimark",[11,34,39,45,52,56,106,110,138,144,148,218,222,252,256],[12,13,14,19,28],"scan-trap",{},[15,16,18],"h3",{"id":17},"security-alert-you-scanned-an-untrusted-qr-code","⚠ Security Alert: You Scanned an Untrusted QR Code!",[20,21,22,23,27],"p",{},"You just triggered a simulated ",[24,25,26],"strong",{},"Quishing (QR Phishing)"," training trap! In a real incident, scanning untrusted physical\nor digital QR codes can covertly exfiltrate credentials, hijack sessions, or execute malicious payloads.",[20,29,30,33],{},[24,31,32],{},"Security Reminder:"," Always inspect destination URLs and never scan unsolicited or publicly posted QR codes without\nverification.",[35,36,38],"h2",{"id":37},"what-is-phishing","What is Phishing?",[20,40,41,44],{},[24,42,43],{},"Phishing"," remains one of the most widespread and damaging cyber attack vectors worldwide. Attackers send fraudulent\ncommunications disguised as trusted organizations—such as Microsoft 365, Google Workspace, postal couriers (DHL, FedEx,\nCzech Post), tax authorities, or popular streaming platforms.",[20,46,47,48,51],{},"The primary objective is almost always to direct the victim to a ",[24,49,50],{},"pixel-perfect fake login page"," where entered\ncredentials (and often active 2FA session tokens via Adversary-in-the-Middle proxies) are harvested by the threat actor.",[35,53,55],{"id":54},"the-phishing-attack-sequence","The Phishing Attack Sequence",[57,58,59],"attack-flow",{},[60,61,62,69,88,94,100],"ol",{},[63,64,65,68],"li",{},[24,66,67],{},"Bait Crafting",": Attackers replicate corporate branding, logos, and email templates (e.g. \"Password expiring in 24\nhours\" or \"Package delivery suspended due to unpaid customs fee\").",[63,70,71,74,75,79,80,83,84,87],{},[24,72,73],{},"Domain Spoofing & Lookalikes",": Scammers register lookalike domains (",[76,77,78],"code",{},"rnicrosoft.com"," ,",[76,81,82],{},"micros0ft-login.com",",",[76,85,86],{},"post-package-tracking.net",") or abuse compromised legitimate domains.",[63,89,90,93],{},[24,91,92],{},"Mass or Targeted Dispatch",": Automated mailers deliver thousands of messages, bypassing basic spam filters with\nhomoglyphs, encoded links, or QR codes (Quishing).",[63,95,96,99],{},[24,97,98],{},"Credential Harvesting",": The victim lands on a fake authentication portal. As soon as user inputs username,\npassword, or SMS OTP, it is relayed directly to the attacker.",[63,101,102,105],{},[24,103,104],{},"Account Takeover (ATO)",": Attackers log into the victim's genuine account, establish mailbox forwarding rules, and\npivot deeper into the corporate network.",[35,107,109],{"id":108},"real-world-simulation","Real-World Simulation",[111,112,116,124,127,130,135],"threat-example",{"channel":113,"icon":114,"sender":115},"Email","i-lucide-mail","IT Helpdesk Notifications \u003Calerts@corplog1n-verify.com>",[20,117,118,119,123],{},"\"Subject: ",[120,121,122],"span",{},"URGENT"," Security Alert: Your Microsoft 365 Session Has Expired",[20,125,126],{},"Dear Employee,",[20,128,129],{},"Our security monitoring detected suspicious sign-in attempts against your account from an unrecognized IP in Warsaw.\nYour access will be locked in 30 minutes unless you verify your identity.",[20,131,132],{},[120,133,134],{},"Click here to confirm your credentials and update password",[20,136,137],{},"Failure to comply will result in an immediate IT security suspension.\"",[20,139,140,141,143],{},"Pay attention to the urgency of the email (",[76,142,122],{}," etc.). Hackers use it to put time\npressure on you, so you will not spot the suspicious details and mistakes in the email.",[35,145,147],{"id":146},"defense-checklist","Defense Checklist",[149,150,152],"defense-tips",{"title":151},"Phishing Prevention Rules",[153,154,155,194,200,206,212],"ul",{},[63,156,157,160,161,164,165,168,169,171,172,175,176,179,180,187,188,193],{},[24,158,159],{},"Inspect the actual sender address, not just display name",": Check the domain after the ",[76,162,163],{},"@"," symbol carefully. Look ",[166,167],"br",{}," --- Unknown node: hardBreak --- ",[166,170],{}," for misspellings, substitute characters (",[76,173,174],{},"rn"," vs ",[76,177,178],{},"m"," - @",[181,182,186],"a",{"href":183,"rel":184},"http:\u002F\u002Fmicrosoft.com",[185],"nofollow","microsoft.com"," vs @",[181,189,192],{"href":190,"rel":191},"http:\u002F\u002Frnicrosoft.com",[185],"rnicrosoft.com,"," etc.), or strange top-level domains.",[63,195,196,199],{},[24,197,198],{},"Hover before clicking",": Hover your cursor over hyperlinks to inspect the destination URL before clicking. If on\nmobile, long-press to view preview.",[63,201,202,205],{},[24,203,204],{},"Never authenticate via links sent in unsolicited emails",": Navigate directly to known services by typing their\naddress into your browser or using verified bookmarks.",[63,207,208,211],{},[24,209,210],{},"Use FIDO2 \u002F Passkey Hardware Authentication",": Phishing-resistant multi-factor authentication (like YubiKeys or\nWindows Hello \u002F Passkeys) prevents credential harvesting even if you land on a spoofed portal.",[63,213,214,217],{},[24,215,216],{},"Beware of QR code emails (Quishing)",": Never scan QR codes embedded in security notifications or password reset\nemails.",[35,219,221],{"id":220},"immediate-actions-if-phished","Immediate Actions If Phished",[223,224,226],"emergency-action",{"title":225},"Clicked a Suspicious Link or Entered Credentials?",[153,227,228,234,240,246],{},[63,229,230,233],{},[24,231,232],{},"Immediately change passwords on legitimate portals",": Do not use the link from the email. Open a new browser window,\nlog into the official service, and change your credentials.",[63,235,236,239],{},[24,237,238],{},"Revoke all active sessions and app passwords",": In Microsoft 365 or Google, trigger a \"Sign out of all devices\"\ncommand.",[63,241,242,245],{},[24,243,244],{},"Inspect email inbox forwarding rules",": Attackers routinely create hidden rules to silently forward incoming emails\nor delete notifications from security teams.",[63,247,248,251],{},[24,249,250],{},"Notify IT Security (SOC)",": Prompt reporting allows defenders to blacklist the phishing domain across the entire\nenterprise gateway and reset impacted tokens.",[35,253,255],{"id":254},"resources-references","Resources & References",[153,257,258,266,274,282],{},[63,259,260,265],{},[181,261,264],{"href":262,"rel":263},"https:\u002F\u002Fwww.kb.cz\u002Fcs\u002Fpodpora\u002Fbezpecnost\u002Ftypy-utoku",[185],"Komerční banka – Bezpečnost a typy útoků"," – Guide on email scams,\nfake e-banking portals, and smishing defense.",[63,267,268,273],{},[181,269,272],{"href":270,"rel":271},"https:\u002F\u002Fwww.cisa.gov\u002Fsecure-our-world\u002Fteach-employees-avoid-phishing",[185],"CISA – Recognizing and Reporting Phishing"," –\nCybersecurity and Infrastructure Security Agency best practices.",[63,275,276,281],{},[181,277,280],{"href":278,"rel":279},"https:\u002F\u002Fwww.nukib.gov.cz\u002F",[185],"NÚKIB – Doporučení k ochraně před phishingem"," – National Cyber and Information Security\nAgency advisory.",[63,283,284,289],{},[181,285,288],{"href":286,"rel":287},"https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1566\u002F",[185],"MITRE ATT&CK – Technique T1566: Phishing"," – Comprehensive adversary\ntactics and techniques index.",{"title":291,"searchDepth":292,"depth":292,"links":293},"",2,[294,296,297,298,299,300,301],{"id":17,"depth":295,"text":18},3,{"id":37,"depth":292,"text":38},{"id":54,"depth":292,"text":55},{"id":108,"depth":292,"text":109},{"id":146,"depth":292,"text":147},{"id":220,"depth":292,"text":221},{"id":254,"depth":292,"text":255},"social-engineering","Deceptive emails, text messages, or direct communications designed to trick users into revealing confidential credentials, banking details, or downloading malware via lookalike websites.","md","https:\u002F\u002Fplay.cyber-framework.net?scenario=phishing","The Phishing Labyrinth","i-lucide-mail-warning",{},true,"\u002Fthreats\u002Fphishing",{"title":6,"description":303},null,{"loc":310},"phishing","threats\u002F01.phishing",[113,317,318,319],"SMS \u002F Smishing","Lookalike Domains (Typosquatting)","Fake Login Portals","vQ4E3-SjHlVYfPDRgOROyamltaASWpsC0HbXldxZS-A",{"id":322,"title":323,"alias":324,"body":325,"category":302,"description":546,"extension":304,"gameScenarioLink":547,"gameScenarioTitle":548,"icon":549,"meta":550,"navigation":309,"path":551,"seo":552,"severity":312,"sitemap":553,"slug":556,"stem":557,"vector":558,"__hash__":562},"threats_en\u002Fthreats\u002F02.vishing.md","Vishing (Voice Phishing)","Voice Phishing & Phone Spoofing",{"type":9,"value":326,"toc":538},[327,331,346,353,357,360,404,406,409,420,424,431,466,470,473,502,504],[35,328,330],{"id":329},"what-is-vishing","What is Vishing?",[20,332,333,336,337,341,342,345],{},[24,334,335],{},"Vishing"," (short for ",[338,339,340],"em",{},"voice phishing",") is a social engineering attack conducted over telephone networks. Unlike\ntraditional email phishing where you can inspect suspicious links and headers at your own pace, vishing exploits\n",[24,343,344],{},"real-time psychological pressure",", authority impersonation, and panic.",[20,347,348,349,352],{},"Attackers frequently spoof legitimate caller IDs so your phone screen displays the actual name or number of your bank's\nfraud department, local police, or corporate IT helpdesk. Advanced threat actors also deploy ",[24,350,351],{},"AI voice cloning (\ndeepfakes)"," replicating the tone and cadence of executives or loved ones.",[35,354,356],{"id":355},"how-attackers-operate","How Attackers Operate",[20,358,359],{},"Attackers rely on emotional manipulation—typically fear, urgency, or helpfulness—to override rational critical thinking.",[57,361,362],{},[60,363,364,380,386,392,398],{},[63,365,366,379],{},[24,367,368,369,378],{},"Target Intelligence (",[24,370,371],{},[24,372,373],{},[181,374,377],{"href":375,"rel":376},"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FOpen-source_intelligence",[185],"OSINT",")",": The caller acquires basic personal details from data leaks, LinkedIn, or social\nmedia (your full name, employer, banking institution, or phone provider).",[63,381,382,385],{},[24,383,384],{},"Caller ID Spoofing",": Attackers configure VoIP software to display a legitimate number—such as your bank's\npublished 24\u002F7 client hotline or police department.",[63,387,388,391],{},[24,389,390],{},"Manufactured Crisis",": The scammer reports that your bank account is \"under active attack\", unauthorized loans are\nbeing approved, or your computer has malware.",[63,393,394,397],{},[24,395,396],{},"The \"Safe Account\" or Remote Access Trap",": The victim is instructed to immediately transfer all funds to a \"secure\nreserve vault\" or install remote support software (AnyDesk, TeamViewer) to \"clean the machine\".",[63,399,400,403],{},[24,401,402],{},"Fund Extraction & Disappearance",": Once transferred or logged in, the funds are instantly laundered through\ncryptocurrency exchanges or offshore mule networks.",[35,405,109],{"id":108},[20,407,408],{},"Here is what a typical high-pressure banking vishing dialogue sounds like:",[111,410,414,417],{"channel":411,"icon":412,"sender":413},"Phone Call","i-lucide-phone-incoming","\"Bank Security Department\" (Spoofed)",[20,415,416],{},"\"Good morning Mr. Anderson. This is Marcus from the Cybersecurity Operations Center at your bank. We are detecting an\nunauthorized wire transfer of $8,400 to an offshore account in Vienna right now.",[20,418,419],{},"To prevent this transaction from settling, I need you to confirm the 6-digit one-time code we just dispatched to your\nmobile phone. Do not hang up—if you disconnect, the funds will irreversibly leave your account.\"",[35,421,423],{"id":422},"how-to-defend-yourself","How to Defend Yourself",[20,425,426,427,430],{},"The golden rule of incoming phone security is simple: ",[24,428,429],{},"never verify a caller using the inbound call itself",".",[149,432,434],{"title":433},"Vishing Defense Checklist",[153,435,436,442,448,454,460],{},[63,437,438,441],{},[24,439,440],{},"Hang up and verify independently",": Never continue a high-stakes call initiated by someone else. Hang up, wait 30\nseconds (or restart the line), and dial the official phone number printed on the back of your payment card or official\ncompany directory.",[63,443,444,447],{},[24,445,446],{},"Banks never ask for full credentials or 2FA codes",": Legitimate bank employees will never ask for your login\npasswords, card PIN, CVC\u002FCVV security code, or push authorization approvals over the phone.",[63,449,450,453],{},[24,451,452],{},"Beware of \"Safe Deposit Accounts\"",": Banks never instruct clients to transfer money into an alternative or temporary\n\"reserve vault\" account to protect it.",[63,455,456,459],{},[24,457,458],{},"Never install remote control software on request",": If a caller asks you to install AnyDesk, TeamViewer, RustDesk,\nor QuickSupport, hang up immediately.",[63,461,462,465],{},[24,463,464],{},"Establish internal verification protocols",": For corporate calls asking for financial transactions or credentials,\nrequire dual-channel out-of-band verification.",[35,467,469],{"id":468},"immediate-actions-if-targeted","Immediate Actions If Targeted",[20,471,472],{},"If you suspect you have disclosed financial data or authorized a fraudulent transaction during a phone call:",[223,474,476],{"title":475},"Compromised via Vishing? Take These Steps Now",[153,477,478,484,490,496],{},[63,479,480,483],{},[24,481,482],{},"Immediately contact your bank's official fraud line",": Request immediate card blocking, internet banking session\ntermination, and transaction recalls. Every minute matters for wire recall requests.",[63,485,486,489],{},[24,487,488],{},"Change all passwords from an uninfected device",": If you installed software or entered passwords on suggested links,\nassume your workstation is compromised. Change passwords and revoke active sessions.",[63,491,492,495],{},[24,493,494],{},"File a report with law enforcement (Police)",": Document the attacker's phone number, time of call, claimed identity,\nand transaction identifiers.",[63,497,498,501],{},[24,499,500],{},"Notify your company's IT \u002F Security Operations (CISO)",": If corporate credentials or workstations were involved,\nreport the incident immediately so credentials can be rotated and endpoints isolated.",[35,503,255],{"id":254},[153,505,506,514,522,530],{},[63,507,508,513],{},[181,509,512],{"href":510,"rel":511},"https:\u002F\u002Fwww.kb.cz\u002Fcs\u002Fpodpora\u002Fbezpecnost\u002Ftypy-utoku\u002Fvishing",[185],"Komerční banka – Podvodné telefonáty (Vishing)"," – Guide on\nspoofed bank calls and caller verification.",[63,515,516,521],{},[181,517,520],{"href":518,"rel":519},"https:\u002F\u002Fcbaczech.cz\u002F",[185],"Czech Banking Association – #NePINdej! Campaign"," – Educational nationwide campaign on banking\nfraud and social engineering.",[63,523,524,529],{},[181,525,528],{"href":526,"rel":527},"https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fnews\u002Favoiding-social-engineering-and-phishing-attacks",[185],"CISA – Avoiding Social Engineering and Phishing Attacks"," –\nVoice phishing and imposter call defense.",[63,531,532,537],{},[181,533,536],{"href":534,"rel":535},"https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1566\u002F004\u002F",[185],"MITRE ATT&CK – Technique T1566.004: Spearphishing Voice"," – Adversary\nmethodology for vishing operations.",{"title":291,"searchDepth":292,"depth":292,"links":539},[540,541,542,543,544,545],{"id":329,"depth":292,"text":330},{"id":355,"depth":292,"text":356},{"id":108,"depth":292,"text":109},{"id":422,"depth":292,"text":423},{"id":468,"depth":292,"text":469},{"id":254,"depth":292,"text":255},"Fraudulent phone calls where attackers impersonate bank officers, police, or IT support using psychological pressure and caller ID spoofing to steal money or credentials.","https:\u002F\u002Fplay.cyber-framework.net?scenario=day-one","First Day","i-lucide-phone-call",{},"\u002Fthreats\u002Fvishing",{"title":323,"description":546},{"loc":551,"videos":554,"images":555},[],[],"vishing","threats\u002F02.vishing",[559,384,560,561],"Phone (Voice)","Audio Deepfakes","Social Engineering","E3QIMt3RJ-53_ay8LTgTwoCBoOawNRczk2aaKQW7pOc",{"id":564,"title":565,"alias":566,"body":567,"category":812,"description":813,"extension":304,"gameScenarioLink":291,"gameScenarioTitle":291,"icon":814,"meta":815,"navigation":309,"path":816,"seo":817,"severity":312,"sitemap":819,"slug":822,"stem":823,"vector":824,"__hash__":829},"threats_en\u002Fthreats\u002F03.ransomware.md","Ransomware & Malicious Attachments","Extortion Ware, Crypto-Lockers & Malicious Payloads",{"type":9,"value":568,"toc":804},[569,573,579,586,597,601,651,655,664,700,702,737,741,770,772],[35,570,572],{"id":571},"what-is-ransomware","What is Ransomware?",[20,574,575,578],{},[24,576,577],{},"Ransomware"," is a devastating class of malware that covertly infiltrates network infrastructure, maps connected shares\nand cloud backups, and deploys military-grade encryption (e.g. AES-256 and RSA-4096) across entire file repositories.",[20,580,581,582,585],{},"Modern ransomware groups practice ",[24,583,584],{},"Double and Triple Extortion",":",[60,587,588,591,594],{},[63,589,590],{},"Encrypting systems to halt daily operations.",[63,592,593],{},"Exfiltrating sensitive customer and intellectual property records to threaten public leaks.",[63,595,596],{},"Conducting distributed denial-of-service (DDoS) attacks or contacting company customers directly to accelerate\npayment.",[35,598,600],{"id":599},"infection-spread-lifecycle","Infection & Spread Lifecycle",[57,602,603],{},[60,604,605,623,633,639,645],{},[63,606,607,610,611,614,615,618,619,622],{},[24,608,609],{},"Initial Access Vector",": An employee opens a macro-enabled invoice (",[76,612,613],{},"Invoice_9042.docm","), a deceptive ZIP archive\ncontaining a disguised ",[76,616,617],{},".vbs"," or ",[76,620,621],{},".exe",", or attackers exploit exposed VPN\u002FRDP portals.",[63,624,625,628,629,632],{},[24,626,627],{},"Persistence & Defense Evasion",": The malware disables endpoint protection, clears Windows Volume Shadow Copies\n(",[76,630,631],{},"vssadmin delete shadows","), and establishes persistence.",[63,634,635,638],{},[24,636,637],{},"Lateral Movement & Domain Escalation",": Attackers harvest local credentials (using tools like Mimikatz), escalate\nto Active Directory Domain Admin, and locate all network storage (NAS\u002FSAN).",[63,640,641,644],{},[24,642,643],{},"Data Exfiltration",": Confidential databases, financial spreadsheets, and emails are compressed and quietly uploaded\nto anonymous cloud storage.",[63,646,647,650],{},[24,648,649],{},"Mass Encryption & Ransom Note",": Encryption scripts trigger simultaneously across domain servers and workstations,\nreplacing desktop wallpapers with ransom instructions.",[35,652,654],{"id":653},"simulated-ransom-note","Simulated Ransom Note",[20,656,657],{},[658,659],"img",{"alt":660,"className":661,"src":663,"title":660},"Ransomware screen example",[662],"w-full","\u002Fthreats\u002Fransomware-screen.webp",[111,665,669,672,675,678,697],{"channel":666,"icon":667,"sender":668},"Ransom Screen Notice","i-lucide-skull","BlackLock Ransomware Group",[20,670,671],{},"\"=== ATTENTION: ALL YOUR IMPORTANT FILES HAVE BEEN ENCRYPTED ===",[20,673,674],{},"All your corporate databases, documents, customer PII, and backups are locked with military-grade encryption algorithms.",[20,676,677],{},"To restore your systems:",[60,679,680,687,694],{},[63,681,682,683],{},"Download the Tor Browser from ",[181,684,685],{"href":685,"rel":686},"https:\u002F\u002Fwww.torproject.org",[185],[63,688,689,690],{},"Open our private portal: ",[181,691,692],{"href":692,"rel":693},"http:\u002F\u002Fblacklock5x9...onion",[185],[63,695,696],{},"Enter your Unique Client ID: 894F-29BC-EE01",[20,698,699],{},"PRICE: 4.5 BTC (Bitcoin). You have 72 hours before the decryption key is permanently deleted and all private files are\nreleased on the public darknet.\"",[35,701,147],{"id":146},[149,703,705],{"title":704},"Ransomware Resilience Rules",[153,706,707,713,719,725,731],{},[63,708,709,712],{},[24,710,711],{},"Maintain Immutable, Offline Backups (3-2-1-1-0 Rule)",": Ensure at least one full backup is physically disconnected\n(air-gapped) or stored in an immutable, write-once-read-many (WORM) cloud repository.",[63,714,715,718],{},[24,716,717],{},"Never enable macros or execute unexpected script attachments",": Office documents asking you to \"Enable Content\" or\n\"Enable Editing\" to view content are almost always weaponized droppers.",[63,720,721,724],{},[24,722,723],{},"Enforce the Principle of Least Privilege",": Standard employee accounts must not have local administrative rights on\ntheir machines.",[63,726,727,730],{},[24,728,729],{},"Isolate and patch remote access interfaces",": Never expose Remote Desktop Protocol (RDP) directly to the open\ninternet; mandate VPN with strict multi-factor authentication.",[63,732,733,736],{},[24,734,735],{},"Deploy Endpoint Detection & Response (EDR)",": Modern behavioral EDR tools can detect mass file modification and\nisolate the infected host automatically.",[35,738,740],{"id":739},"immediate-incident-containment","Immediate Incident Containment",[223,742,744],{"title":743},"Ransomware Detected? Take Instant Containment Actions",[153,745,746,752,758,764],{},[63,747,748,751],{},[24,749,750],{},"Disconnect immediately from physical networks",": Unplug ethernet cables and turn off Wi-Fi and Bluetooth on all\naffected devices immediately. DO NOT turn off the power (RAM holds crucial decryption keys and malware artifacts).",[63,753,754,757],{},[24,755,756],{},"Do not pay the ransom",": Cybersecurity authorities and law enforcement strongly advise against paying ransoms.\nPayment fuels criminal syndicates, does not guarantee data recovery, and marks your company as an easy repeat target.",[63,759,760,763],{},[24,761,762],{},"Isolate network segments and storage arrays",": Take offline network-attached storage and shared drives to stop\nencryption traversal.",[63,765,766,769],{},[24,767,768],{},"Contact certified forensic responders & law enforcement",": Engage certified incident response teams to secure\nforensic evidence and guide secure recovery from immutable backups.",[35,771,255],{"id":254},[153,773,774,782,789,796],{},[63,775,776,781],{},[181,777,780],{"href":778,"rel":779},"https:\u002F\u002Fwww.cisa.gov\u002Fstopransomware",[185],"CISA #StopRansomware"," – Official U.S. government guidance, threat alerts, and\nransomware playbooks.",[63,783,784,788],{},[181,785,787],{"href":262,"rel":786},[185],"Komerční banka – Škodlivý software a ochrana dat"," – Banking\nclient advisory on malware infections and prevention.",[63,790,791,795],{},[181,792,794],{"href":278,"rel":793},[185],"NÚKIB – Reakce na ransomware incidenty"," – National Cyber and Information Security Agency\nransomware defense guide.",[63,797,798,803],{},[181,799,802],{"href":800,"rel":801},"https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1486\u002F",[185],"MITRE ATT&CK – Technique T1486: Data Encrypted for Impact"," – Tactical\nbreakdown of ransomware encryption behaviors.",{"title":291,"searchDepth":292,"depth":292,"links":805},[806,807,808,809,810,811],{"id":571,"depth":292,"text":572},{"id":599,"depth":292,"text":600},{"id":653,"depth":292,"text":654},{"id":146,"depth":292,"text":147},{"id":739,"depth":292,"text":740},{"id":254,"depth":292,"text":255},"malware","Malicious software that encrypts vital business files, databases, and backup systems, demanding enourmous cryptocurrency ransoms under threat of permanent data destruction or public leaks.","i-lucide-lock-keyhole",{},"\u002Fthreats\u002Fransomware",{"title":565,"description":818},"Malicious software that encrypts vital business files, databases, and backup systems, demanding exorbitant cryptocurrency ransoms under threat of permanent data destruction or public leaks.",{"loc":816,"videos":820,"images":821},[],[],"ransomware","threats\u002F03.ransomware",[825,826,827,828],"Weaponized Attachments (PDF, Office macros, ZIP\u002FISO)","Drive-by Downloads","Compromised Remote Desktop (RDP)","Unpatched Software Vulnerabilities","7PQfpCikml7DgKVB8SCpY_YutgGtoDUW9hxpn2xPpzE",{"id":5,"title":6,"alias":7,"body":831,"category":302,"description":303,"extension":304,"gameScenarioLink":305,"gameScenarioTitle":306,"icon":307,"meta":1006,"navigation":309,"path":310,"seo":1007,"severity":312,"sitemap":1008,"slug":314,"stem":315,"vector":1009,"__hash__":320},{"type":9,"value":832,"toc":997},[833,845,847,851,855,857,887,889,905,909,911,951,953,973,975],[12,834,835,837,841],{},[15,836,18],{"id":17},[20,838,22,839,27],{},[24,840,26],{},[20,842,843,33],{},[24,844,32],{},[35,846,38],{"id":37},[20,848,849,44],{},[24,850,43],{},[20,852,47,853,51],{},[24,854,50],{},[35,856,55],{"id":54},[57,858,859],{},[60,860,861,865,875,879,883],{},[63,862,863,68],{},[24,864,67],{},[63,866,867,74,869,79,871,83,873,87],{},[24,868,73],{},[76,870,78],{},[76,872,82],{},[76,874,86],{},[63,876,877,93],{},[24,878,92],{},[63,880,881,99],{},[24,882,98],{},[63,884,885,105],{},[24,886,104],{},[35,888,109],{"id":108},[111,890,891,895,897,899,903],{"channel":113,"icon":114,"sender":115},[20,892,118,893,123],{},[120,894,122],{},[20,896,126],{},[20,898,129],{},[20,900,901],{},[120,902,134],{},[20,904,137],{},[20,906,140,907,143],{},[76,908,122],{},[35,910,147],{"id":146},[149,912,913],{"title":151},[153,914,915,935,939,943,947],{},[63,916,917,160,919,164,921,168,923,171,925,175,927,179,929,187,932,193],{},[24,918,159],{},[76,920,163],{},[166,922],{},[166,924],{},[76,926,174],{},[76,928,178],{},[181,930,186],{"href":183,"rel":931},[185],[181,933,192],{"href":190,"rel":934},[185],[63,936,937,199],{},[24,938,198],{},[63,940,941,205],{},[24,942,204],{},[63,944,945,211],{},[24,946,210],{},[63,948,949,217],{},[24,950,216],{},[35,952,221],{"id":220},[223,954,955],{"title":225},[153,956,957,961,965,969],{},[63,958,959,233],{},[24,960,232],{},[63,962,963,239],{},[24,964,238],{},[63,966,967,245],{},[24,968,244],{},[63,970,971,251],{},[24,972,250],{},[35,974,255],{"id":254},[153,976,977,982,987,992],{},[63,978,979,265],{},[181,980,264],{"href":262,"rel":981},[185],[63,983,984,273],{},[181,985,272],{"href":270,"rel":986},[185],[63,988,989,281],{},[181,990,280],{"href":278,"rel":991},[185],[63,993,994,289],{},[181,995,288],{"href":286,"rel":996},[185],{"title":291,"searchDepth":292,"depth":292,"links":998},[999,1000,1001,1002,1003,1004,1005],{"id":17,"depth":295,"text":18},{"id":37,"depth":292,"text":38},{"id":54,"depth":292,"text":55},{"id":108,"depth":292,"text":109},{"id":146,"depth":292,"text":147},{"id":220,"depth":292,"text":221},{"id":254,"depth":292,"text":255},{},{"title":6,"description":303},{"loc":310},[113,317,318,319],{"id":1011,"title":1012,"alias":1013,"body":1014,"category":302,"description":1262,"extension":304,"gameScenarioLink":547,"gameScenarioTitle":1263,"icon":307,"meta":1264,"navigation":309,"path":1265,"seo":1266,"severity":312,"sitemap":1267,"slug":314,"stem":1268,"vector":1269,"__hash__":1273},"threats_cs\u002Fcs\u002Fhrozby\u002F01.phishing.md","Phishing (Podvodné e-maily & krádež údajů)","E-mailový phishing, Smishing a falešné weby",{"type":9,"value":1015,"toc":1253},[1016,1038,1042,1047,1054,1058,1102,1106,1131,1137,1141,1185,1189,1219,1223],[12,1017,1021,1025,1032],{"badge":1018,"description":1019,"title":1020},"Simulovaný test zachycen","Simulovaný nácvik obrany proti Quishingu (QR Phishing)","Bezpečnostní upozornění: Naskenovali jste neznámý QR kód!",[15,1022,1024],{"id":1023},"pozor-právě-jste-aktivovali-simulovanou-past","⚠ Pozor: Právě jste aktivovali simulovanou past!",[20,1026,1027,1028,1031],{},"Naletěli jste na cvičný ",[24,1029,1030],{},"Quishing (QR kódový phishing)",". V reálném útoku může naskenování neznámého QR kódu na\nveřejném místě, plakátu nebo v e-mailu okamžitě vést ke krádeži relace, přihlašovacích údajů nebo instalaci malwaru.",[20,1033,1034,1037],{},[24,1035,1036],{},"Zlaté pravidlo bezpečnosti:"," Nikdy neskenujte neověřené QR kódy a vždy kontrolujte cílovou webovou adresu před\nzadáním jakýchkoli údajů.",[35,1039,1041],{"id":1040},"co-je-to-phishing","Co je to Phishing?",[20,1043,1044,1046],{},[24,1045,43],{}," (rybaření údajů) patří k nejrozšířenějším a nejnebezpečnějším kybernetickým útokům na světě. Útočníci\nrozesílají zprávy, které se tváří jako oficiální sdělení od známých organizací – např. Microsoft 365, České pošty,\nkurýrní služby (Zásilkovna, DPD, DHL), Finanční správa nebo streamovací platformy.",[20,1048,1049,1050,1053],{},"Cílem je přimět oběť kliknout na přiložený odkaz a vstoupit na ",[24,1051,1052],{},"dokonalou kopii přihlašovací stránky",", kde zadané\npřihlašovací jméno, heslo nebo údaje z platební karty okamžitě zachytí útočník.",[35,1055,1057],{"id":1056},"jak-útok-probíhá","Jak útok probíhá",[57,1059,1062],{"description":1060,"title":1061},"Kroky, kterými útočník manipuluje uživatele k předání údajů.","Průběh typického phishingového útoku",[60,1063,1064,1070,1084,1090,1096],{},[63,1065,1066,1069],{},[24,1067,1068],{},"Příprava návnady",": Útočník vytvoří šablonu zprávy věrně kopírující firemní grafiku (např. „Vaše heslo vyprší za 24\nhodin“ nebo „Doplatit celní poplatek za balíček 45 Kč“).",[63,1071,1072,1075,1076,1079,1080,1083],{},[24,1073,1074],{},"Registrace podobné domény",": Zaregistruje adresu, která se na první pohled podobá originálu\n(",[76,1077,1078],{},"ceskap0sta-sledovani.cz",", ",[76,1081,1082],{},"login-microsoft-secure.com",").",[63,1085,1086,1089],{},[24,1087,1088],{},"Rozeslání zpráv",": Hromadně nebo cíleně (spear phishing) odešle tisíce e-mailů s důrazem na okamžitou reakci.",[63,1091,1092,1095],{},[24,1093,1094],{},"Odchyt údajů",": Uživatel vstoupí na falešnou stránku a zadá přihlašovací údaje. Pokud je vyžadován SMS kód, útočník\njej v reálném čase přepošle do skutečné služby.",[63,1097,1098,1101],{},[24,1099,1100],{},"Převzetí účtu (Account Takeover)",": Útočník se přihlásí k účtu, nastaví pravidla pro skryté přeposílání e-mailů a\npokračuje v útoku hlouběji do sítě.",[35,1103,1105],{"id":1104},"příklad-phishingového-e-mailu","Příklad phishingového e-mailu",[111,1107,1110,1117,1120,1123,1128],{"channel":1108,"icon":114,"sender":1109},"E-mail","IT Podpora firmy \u003Csprava-uctu@ms-firemni-portal.com>",[20,1111,1112,1113,1116],{},"„Předmět: ",[120,1114,1115],{},"DŮLEŽITÉ"," Vypršení platnosti bezpečnostního certifikátu účtu",[20,1118,1119],{},"Vážený uživateli,",[20,1121,1122],{},"V rámci plánované údržby serveru došlo k vypršení vašeho hesla do Microsoft 365. Pokud neprovedete revalidaci do 60\nminut, bude váš přístup k poštovní schránce zablokován.",[20,1124,1125],{},[120,1126,1127],{},"Klikněte zde pro potvrzení identity a obnovu přístupu",[20,1129,1130],{},"Oddělení správy firemních systémů.“",[20,1132,1133,1134,1136],{},"Všimněte si urgentnosti (",[76,1135,1115],{}," apod.), kterou útočník klade. Snaží se vás dostat do časového tlaku, ve kterém si\nmožná nevšimnete podezřelých detailů a chyb v emailu.",[35,1138,1140],{"id":1139},"zásady-spolehlivé-ochrany","Zásady spolehlivé ochrany",[149,1142,1144],{"title":1143},"Jak bezpečně odhalit phishing",[153,1145,1146,1161,1167,1173,1179],{},[63,1147,1148,1151,1152,1154,1155,1157,1158,1160],{},[24,1149,1150],{},"Vždy kontrolujte skutečnou adresu odesílatele",": Nespoléhejte se na zobrazované jméno. Důkladně prozkoumejte doménu\nza zavináčem ",[76,1153,163],{}," – hledejte překlepy, záměnu písmen (např. ",[76,1156,174],{}," místo ",[76,1159,178],{}," - @microsoft.com vs @rnicrosoft.com) nebo neobvyklé koncovky.",[63,1162,1163,1166],{},[24,1164,1165],{},"Přejeďte myší přes odkaz před kliknutím",": Než na jakýkoli odkaz kliknete, najeďte na něj kurzorem myši a\nzkontrolujte skutečnou cílovou URL adresu v dolním rohu prohlížeče.",[63,1168,1169,1172],{},[24,1170,1171],{},"Nikdy se nepřihlašujte přes odkazy v nevyžádaných e-mailech",": Otevřete nový panel prohlížeče a zadejte známou\noficiální adresu přímo, nebo použijte své uložené záložky.",[63,1174,1175,1178],{},[24,1176,1177],{},"Používejte moderní vícefaktorové ověření (FIDO2 \u002F Passkeys)",": Hardwarové klíče (YubiKey) a passkeys jsou technicky imunní vůči odchycení na falešné doméně.",[63,1180,1181,1184],{},[24,1182,1183],{},"Pozor na podvodné QR kódy (Quishing)",": Nikdy neskenujte QR kódy v e-mailech požadujících obnovení hesla či ověření\nbankovnictví.",[35,1186,1188],{"id":1187},"první-pomoc-při-zadání-údajů","První pomoc při zadání údajů",[223,1190,1193],{"description":1191,"title":1192},"Pokud jste zadali heslo, poslali peníze nebo kliknuli na odkaz, jednejte okamžitě.","Klikli jste na odkaz nebo zadali heslo?",[153,1194,1195,1201,1207,1213],{},[63,1196,1197,1200],{},[24,1198,1199],{},"Okamžitě změňte heslo z čistého prohlížeče",": Otevřete oficiální web dané služby přímo (nikoli z podezřelého\ne-mailu) a změňte si heslo.",[63,1202,1203,1206],{},[24,1204,1205],{},"Odhlaste všechny aktivní relace",": Ve správě účtu (Microsoft, Google, Apple) zvolte možnost „Odhlásit ze všech\nzařízení“.",[63,1208,1209,1212],{},[24,1210,1211],{},"Zkontrolujte pravidla poštovní schránky",": Prověřte, zda útočník nevytvořil skrytá pravidla pro přeposílání či\nmazání pošty.",[63,1214,1215,1218],{},[24,1216,1217],{},"Informujte správce IT \u002F Bezpečnostní tým",": Včasné hlášení umožní zablokovat škodlivou doménu pro celou organizaci a ochránit ostatní kolegy.",[35,1220,1222],{"id":1221},"zdroje-a-doporučená-literatura","Zdroje a doporučená literatura",[153,1224,1225,1232,1238,1246],{},[63,1226,1227,1231],{},[181,1228,1230],{"href":262,"rel":1229},[185],"Komerční banka – Typy útoků a podvodné zprávy"," – Edukační rozbor\npodvodných e-mailů, falešných webů a SMS podvodů.",[63,1233,1234,1237],{},[181,1235,280],{"href":278,"rel":1236},[185]," – Oficiální metodika a varování Národního\núřadu pro kybernetickou a informační bezpečnost.",[63,1239,1240,1245],{},[181,1241,1244],{"href":1242,"rel":1243},"https:\u002F\u002Fwww.csirt.cz\u002F",[185],"CSIRT.CZ – Národní bezpečnostní tým ČR"," – Analýza phishingových kampaní a hlášení incidentů v\nčeském internetu.",[63,1247,1248,1252],{},[181,1249,1251],{"href":286,"rel":1250},[185],"MITRE ATT&CK – Technika T1566: Phishing"," – Globální znalostní báze\ntaktik kybernetických útočníků.",{"title":291,"searchDepth":292,"depth":292,"links":1254},[1255,1256,1257,1258,1259,1260,1261],{"id":1023,"depth":295,"text":1024},{"id":1040,"depth":292,"text":1041},{"id":1056,"depth":292,"text":1057},{"id":1104,"depth":292,"text":1105},{"id":1139,"depth":292,"text":1140},{"id":1187,"depth":292,"text":1188},{"id":1221,"depth":292,"text":1222},"Klamavé e-maily, SMS zprávy nebo zprávy na sociálních sítích, které předstírají, že pocházejí od důvěryhodné instituce, s cílem vylákat přihlašovací údaje, hesla nebo platební karty.","Phishingový labyrint",{},"\u002Fcs\u002Fhrozby\u002Fphishing",{"title":1012,"description":1262},{"loc":1265},"cs\u002Fhrozby\u002F01.phishing",[1108,1270,1271,1272],"SMS (Smishing)","Podvržené domény (Typosquatting)","Falešné přihlašovací portály","G_AvKEzozfkMl5UyeYCQgvwaqVQb2aS1s8THL6rHncE",[312,1275],{"title":323,"path":551,"stem":557,"description":546,"children":-1},1792020367308]