[{"data":1,"prerenderedAt":1218},["ShallowReactive",2],{"threats-nav-data-en":3,"threat-en-vishing":830,"threat-counterpart-en-vishing":984,"threat-surround-en-vishing":1215},[4,321,563],{"id":5,"title":6,"alias":7,"body":8,"category":302,"description":303,"extension":304,"gameScenarioLink":305,"gameScenarioTitle":306,"icon":307,"meta":308,"navigation":309,"path":310,"seo":311,"severity":312,"sitemap":313,"slug":314,"stem":315,"vector":316,"__hash__":320},"threats_en\u002Fthreats\u002F01.phishing.md","Phishing (Credential Harvesting & Scams)","Email Phishing, Smishing & Deceptive Portals",{"type":9,"value":10,"toc":290},"minimark",[11,34,39,45,52,56,106,110,138,144,148,218,222,252,256],[12,13,14,19,28],"scan-trap",{},[15,16,18],"h3",{"id":17},"security-alert-you-scanned-an-untrusted-qr-code","⚠ Security Alert: You Scanned an Untrusted QR Code!",[20,21,22,23,27],"p",{},"You just triggered a simulated ",[24,25,26],"strong",{},"Quishing (QR Phishing)"," training trap! In a real incident, scanning untrusted physical\nor digital QR codes can covertly exfiltrate credentials, hijack sessions, or execute malicious payloads.",[20,29,30,33],{},[24,31,32],{},"Security Reminder:"," Always inspect destination URLs and never scan unsolicited or publicly posted QR codes without\nverification.",[35,36,38],"h2",{"id":37},"what-is-phishing","What is Phishing?",[20,40,41,44],{},[24,42,43],{},"Phishing"," remains one of the most widespread and damaging cyber attack vectors worldwide. Attackers send fraudulent\ncommunications disguised as trusted organizations—such as Microsoft 365, Google Workspace, postal couriers (DHL, FedEx,\nCzech Post), tax authorities, or popular streaming platforms.",[20,46,47,48,51],{},"The primary objective is almost always to direct the victim to a ",[24,49,50],{},"pixel-perfect fake login page"," where entered\ncredentials (and often active 2FA session tokens via Adversary-in-the-Middle proxies) are harvested by the threat actor.",[35,53,55],{"id":54},"the-phishing-attack-sequence","The Phishing Attack Sequence",[57,58,59],"attack-flow",{},[60,61,62,69,88,94,100],"ol",{},[63,64,65,68],"li",{},[24,66,67],{},"Bait Crafting",": Attackers replicate corporate branding, logos, and email templates (e.g. \"Password expiring in 24\nhours\" or \"Package delivery suspended due to unpaid customs fee\").",[63,70,71,74,75,79,80,83,84,87],{},[24,72,73],{},"Domain Spoofing & Lookalikes",": Scammers register lookalike domains (",[76,77,78],"code",{},"rnicrosoft.com"," ,",[76,81,82],{},"micros0ft-login.com",",",[76,85,86],{},"post-package-tracking.net",") or abuse compromised legitimate domains.",[63,89,90,93],{},[24,91,92],{},"Mass or Targeted Dispatch",": Automated mailers deliver thousands of messages, bypassing basic spam filters with\nhomoglyphs, encoded links, or QR codes (Quishing).",[63,95,96,99],{},[24,97,98],{},"Credential Harvesting",": The victim lands on a fake authentication portal. As soon as user inputs username,\npassword, or SMS OTP, it is relayed directly to the attacker.",[63,101,102,105],{},[24,103,104],{},"Account Takeover (ATO)",": Attackers log into the victim's genuine account, establish mailbox forwarding rules, and\npivot deeper into the corporate network.",[35,107,109],{"id":108},"real-world-simulation","Real-World Simulation",[111,112,116,124,127,130,135],"threat-example",{"channel":113,"icon":114,"sender":115},"Email","i-lucide-mail","IT Helpdesk Notifications \u003Calerts@corplog1n-verify.com>",[20,117,118,119,123],{},"\"Subject: ",[120,121,122],"span",{},"URGENT"," Security Alert: Your Microsoft 365 Session Has Expired",[20,125,126],{},"Dear Employee,",[20,128,129],{},"Our security monitoring detected suspicious sign-in attempts against your account from an unrecognized IP in Warsaw.\nYour access will be locked in 30 minutes unless you verify your identity.",[20,131,132],{},[120,133,134],{},"Click here to confirm your credentials and update password",[20,136,137],{},"Failure to comply will result in an immediate IT security suspension.\"",[20,139,140,141,143],{},"Pay attention to the urgency of the email (",[76,142,122],{}," etc.). Hackers use it to put time\npressure on you, so you will not spot the suspicious details and mistakes in the email.",[35,145,147],{"id":146},"defense-checklist","Defense Checklist",[149,150,152],"defense-tips",{"title":151},"Phishing Prevention Rules",[153,154,155,194,200,206,212],"ul",{},[63,156,157,160,161,164,165,168,169,171,172,175,176,179,180,187,188,193],{},[24,158,159],{},"Inspect the actual sender address, not just display name",": Check the domain after the ",[76,162,163],{},"@"," symbol carefully. Look ",[166,167],"br",{}," --- Unknown node: hardBreak --- ",[166,170],{}," for misspellings, substitute characters (",[76,173,174],{},"rn"," vs ",[76,177,178],{},"m"," - @",[181,182,186],"a",{"href":183,"rel":184},"http:\u002F\u002Fmicrosoft.com",[185],"nofollow","microsoft.com"," vs @",[181,189,192],{"href":190,"rel":191},"http:\u002F\u002Frnicrosoft.com",[185],"rnicrosoft.com,"," etc.), or strange top-level domains.",[63,195,196,199],{},[24,197,198],{},"Hover before clicking",": Hover your cursor over hyperlinks to inspect the destination URL before clicking. If on\nmobile, long-press to view preview.",[63,201,202,205],{},[24,203,204],{},"Never authenticate via links sent in unsolicited emails",": Navigate directly to known services by typing their\naddress into your browser or using verified bookmarks.",[63,207,208,211],{},[24,209,210],{},"Use FIDO2 \u002F Passkey Hardware Authentication",": Phishing-resistant multi-factor authentication (like YubiKeys or\nWindows Hello \u002F Passkeys) prevents credential harvesting even if you land on a spoofed portal.",[63,213,214,217],{},[24,215,216],{},"Beware of QR code emails (Quishing)",": Never scan QR codes embedded in security notifications or password reset\nemails.",[35,219,221],{"id":220},"immediate-actions-if-phished","Immediate Actions If Phished",[223,224,226],"emergency-action",{"title":225},"Clicked a Suspicious Link or Entered Credentials?",[153,227,228,234,240,246],{},[63,229,230,233],{},[24,231,232],{},"Immediately change passwords on legitimate portals",": Do not use the link from the email. Open a new browser window,\nlog into the official service, and change your credentials.",[63,235,236,239],{},[24,237,238],{},"Revoke all active sessions and app passwords",": In Microsoft 365 or Google, trigger a \"Sign out of all devices\"\ncommand.",[63,241,242,245],{},[24,243,244],{},"Inspect email inbox forwarding rules",": Attackers routinely create hidden rules to silently forward incoming emails\nor delete notifications from security teams.",[63,247,248,251],{},[24,249,250],{},"Notify IT Security (SOC)",": Prompt reporting allows defenders to blacklist the phishing domain across the entire\nenterprise gateway and reset impacted tokens.",[35,253,255],{"id":254},"resources-references","Resources & References",[153,257,258,266,274,282],{},[63,259,260,265],{},[181,261,264],{"href":262,"rel":263},"https:\u002F\u002Fwww.kb.cz\u002Fcs\u002Fpodpora\u002Fbezpecnost\u002Ftypy-utoku",[185],"Komerční banka – Bezpečnost a typy útoků"," – Guide on email scams,\nfake e-banking portals, and smishing defense.",[63,267,268,273],{},[181,269,272],{"href":270,"rel":271},"https:\u002F\u002Fwww.cisa.gov\u002Fsecure-our-world\u002Fteach-employees-avoid-phishing",[185],"CISA – Recognizing and Reporting Phishing"," –\nCybersecurity and Infrastructure Security Agency best practices.",[63,275,276,281],{},[181,277,280],{"href":278,"rel":279},"https:\u002F\u002Fwww.nukib.gov.cz\u002F",[185],"NÚKIB – Doporučení k ochraně před phishingem"," – National Cyber and Information Security\nAgency advisory.",[63,283,284,289],{},[181,285,288],{"href":286,"rel":287},"https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1566\u002F",[185],"MITRE ATT&CK – Technique T1566: Phishing"," – Comprehensive adversary\ntactics and techniques index.",{"title":291,"searchDepth":292,"depth":292,"links":293},"",2,[294,296,297,298,299,300,301],{"id":17,"depth":295,"text":18},3,{"id":37,"depth":292,"text":38},{"id":54,"depth":292,"text":55},{"id":108,"depth":292,"text":109},{"id":146,"depth":292,"text":147},{"id":220,"depth":292,"text":221},{"id":254,"depth":292,"text":255},"social-engineering","Deceptive emails, text messages, or direct communications designed to trick users into revealing confidential credentials, banking details, or downloading malware via lookalike websites.","md","https:\u002F\u002Fplay.cyber-framework.net?scenario=phishing","The Phishing Labyrinth","i-lucide-mail-warning",{},true,"\u002Fthreats\u002Fphishing",{"title":6,"description":303},null,{"loc":310},"phishing","threats\u002F01.phishing",[113,317,318,319],"SMS \u002F Smishing","Lookalike Domains (Typosquatting)","Fake Login Portals","vQ4E3-SjHlVYfPDRgOROyamltaASWpsC0HbXldxZS-A",{"id":322,"title":323,"alias":324,"body":325,"category":302,"description":546,"extension":304,"gameScenarioLink":547,"gameScenarioTitle":548,"icon":549,"meta":550,"navigation":309,"path":551,"seo":552,"severity":312,"sitemap":553,"slug":556,"stem":557,"vector":558,"__hash__":562},"threats_en\u002Fthreats\u002F02.vishing.md","Vishing (Voice Phishing)","Voice Phishing & Phone Spoofing",{"type":9,"value":326,"toc":538},[327,331,346,353,357,360,404,406,409,420,424,431,466,470,473,502,504],[35,328,330],{"id":329},"what-is-vishing","What is Vishing?",[20,332,333,336,337,341,342,345],{},[24,334,335],{},"Vishing"," (short for ",[338,339,340],"em",{},"voice phishing",") is a social engineering attack conducted over telephone networks. Unlike\ntraditional email phishing where you can inspect suspicious links and headers at your own pace, vishing exploits\n",[24,343,344],{},"real-time psychological pressure",", authority impersonation, and panic.",[20,347,348,349,352],{},"Attackers frequently spoof legitimate caller IDs so your phone screen displays the actual name or number of your bank's\nfraud department, local police, or corporate IT helpdesk. Advanced threat actors also deploy ",[24,350,351],{},"AI voice cloning (\ndeepfakes)"," replicating the tone and cadence of executives or loved ones.",[35,354,356],{"id":355},"how-attackers-operate","How Attackers Operate",[20,358,359],{},"Attackers rely on emotional manipulation—typically fear, urgency, or helpfulness—to override rational critical thinking.",[57,361,362],{},[60,363,364,380,386,392,398],{},[63,365,366,379],{},[24,367,368,369,378],{},"Target Intelligence (",[24,370,371],{},[24,372,373],{},[181,374,377],{"href":375,"rel":376},"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FOpen-source_intelligence",[185],"OSINT",")",": The caller acquires basic personal details from data leaks, LinkedIn, or social\nmedia (your full name, employer, banking institution, or phone provider).",[63,381,382,385],{},[24,383,384],{},"Caller ID Spoofing",": Attackers configure VoIP software to display a legitimate number—such as your bank's\npublished 24\u002F7 client hotline or police department.",[63,387,388,391],{},[24,389,390],{},"Manufactured Crisis",": The scammer reports that your bank account is \"under active attack\", unauthorized loans are\nbeing approved, or your computer has malware.",[63,393,394,397],{},[24,395,396],{},"The \"Safe Account\" or Remote Access Trap",": The victim is instructed to immediately transfer all funds to a \"secure\nreserve vault\" or install remote support software (AnyDesk, TeamViewer) to \"clean the machine\".",[63,399,400,403],{},[24,401,402],{},"Fund Extraction & Disappearance",": Once transferred or logged in, the funds are instantly laundered through\ncryptocurrency exchanges or offshore mule networks.",[35,405,109],{"id":108},[20,407,408],{},"Here is what a typical high-pressure banking vishing dialogue sounds like:",[111,410,414,417],{"channel":411,"icon":412,"sender":413},"Phone Call","i-lucide-phone-incoming","\"Bank Security Department\" (Spoofed)",[20,415,416],{},"\"Good morning Mr. Anderson. This is Marcus from the Cybersecurity Operations Center at your bank. We are detecting an\nunauthorized wire transfer of $8,400 to an offshore account in Vienna right now.",[20,418,419],{},"To prevent this transaction from settling, I need you to confirm the 6-digit one-time code we just dispatched to your\nmobile phone. Do not hang up—if you disconnect, the funds will irreversibly leave your account.\"",[35,421,423],{"id":422},"how-to-defend-yourself","How to Defend Yourself",[20,425,426,427,430],{},"The golden rule of incoming phone security is simple: ",[24,428,429],{},"never verify a caller using the inbound call itself",".",[149,432,434],{"title":433},"Vishing Defense Checklist",[153,435,436,442,448,454,460],{},[63,437,438,441],{},[24,439,440],{},"Hang up and verify independently",": Never continue a high-stakes call initiated by someone else. Hang up, wait 30\nseconds (or restart the line), and dial the official phone number printed on the back of your payment card or official\ncompany directory.",[63,443,444,447],{},[24,445,446],{},"Banks never ask for full credentials or 2FA codes",": Legitimate bank employees will never ask for your login\npasswords, card PIN, CVC\u002FCVV security code, or push authorization approvals over the phone.",[63,449,450,453],{},[24,451,452],{},"Beware of \"Safe Deposit Accounts\"",": Banks never instruct clients to transfer money into an alternative or temporary\n\"reserve vault\" account to protect it.",[63,455,456,459],{},[24,457,458],{},"Never install remote control software on request",": If a caller asks you to install AnyDesk, TeamViewer, RustDesk,\nor QuickSupport, hang up immediately.",[63,461,462,465],{},[24,463,464],{},"Establish internal verification protocols",": For corporate calls asking for financial transactions or credentials,\nrequire dual-channel out-of-band verification.",[35,467,469],{"id":468},"immediate-actions-if-targeted","Immediate Actions If Targeted",[20,471,472],{},"If you suspect you have disclosed financial data or authorized a fraudulent transaction during a phone call:",[223,474,476],{"title":475},"Compromised via Vishing? Take These Steps Now",[153,477,478,484,490,496],{},[63,479,480,483],{},[24,481,482],{},"Immediately contact your bank's official fraud line",": Request immediate card blocking, internet banking session\ntermination, and transaction recalls. Every minute matters for wire recall requests.",[63,485,486,489],{},[24,487,488],{},"Change all passwords from an uninfected device",": If you installed software or entered passwords on suggested links,\nassume your workstation is compromised. Change passwords and revoke active sessions.",[63,491,492,495],{},[24,493,494],{},"File a report with law enforcement (Police)",": Document the attacker's phone number, time of call, claimed identity,\nand transaction identifiers.",[63,497,498,501],{},[24,499,500],{},"Notify your company's IT \u002F Security Operations (CISO)",": If corporate credentials or workstations were involved,\nreport the incident immediately so credentials can be rotated and endpoints isolated.",[35,503,255],{"id":254},[153,505,506,514,522,530],{},[63,507,508,513],{},[181,509,512],{"href":510,"rel":511},"https:\u002F\u002Fwww.kb.cz\u002Fcs\u002Fpodpora\u002Fbezpecnost\u002Ftypy-utoku\u002Fvishing",[185],"Komerční banka – Podvodné telefonáty (Vishing)"," – Guide on\nspoofed bank calls and caller verification.",[63,515,516,521],{},[181,517,520],{"href":518,"rel":519},"https:\u002F\u002Fcbaczech.cz\u002F",[185],"Czech Banking Association – #NePINdej! Campaign"," – Educational nationwide campaign on banking\nfraud and social engineering.",[63,523,524,529],{},[181,525,528],{"href":526,"rel":527},"https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fnews\u002Favoiding-social-engineering-and-phishing-attacks",[185],"CISA – Avoiding Social Engineering and Phishing Attacks"," –\nVoice phishing and imposter call defense.",[63,531,532,537],{},[181,533,536],{"href":534,"rel":535},"https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1566\u002F004\u002F",[185],"MITRE ATT&CK – Technique T1566.004: Spearphishing Voice"," – Adversary\nmethodology for vishing operations.",{"title":291,"searchDepth":292,"depth":292,"links":539},[540,541,542,543,544,545],{"id":329,"depth":292,"text":330},{"id":355,"depth":292,"text":356},{"id":108,"depth":292,"text":109},{"id":422,"depth":292,"text":423},{"id":468,"depth":292,"text":469},{"id":254,"depth":292,"text":255},"Fraudulent phone calls where attackers impersonate bank officers, police, or IT support using psychological pressure and caller ID spoofing to steal money or credentials.","https:\u002F\u002Fplay.cyber-framework.net?scenario=day-one","First Day","i-lucide-phone-call",{},"\u002Fthreats\u002Fvishing",{"title":323,"description":546},{"loc":551,"videos":554,"images":555},[],[],"vishing","threats\u002F02.vishing",[559,384,560,561],"Phone (Voice)","Audio Deepfakes","Social Engineering","E3QIMt3RJ-53_ay8LTgTwoCBoOawNRczk2aaKQW7pOc",{"id":564,"title":565,"alias":566,"body":567,"category":812,"description":813,"extension":304,"gameScenarioLink":291,"gameScenarioTitle":291,"icon":814,"meta":815,"navigation":309,"path":816,"seo":817,"severity":312,"sitemap":819,"slug":822,"stem":823,"vector":824,"__hash__":829},"threats_en\u002Fthreats\u002F03.ransomware.md","Ransomware & Malicious Attachments","Extortion Ware, Crypto-Lockers & Malicious Payloads",{"type":9,"value":568,"toc":804},[569,573,579,586,597,601,651,655,664,700,702,737,741,770,772],[35,570,572],{"id":571},"what-is-ransomware","What is Ransomware?",[20,574,575,578],{},[24,576,577],{},"Ransomware"," is a devastating class of malware that covertly infiltrates network infrastructure, maps connected shares\nand cloud backups, and deploys military-grade encryption (e.g. AES-256 and RSA-4096) across entire file repositories.",[20,580,581,582,585],{},"Modern ransomware groups practice ",[24,583,584],{},"Double and Triple Extortion",":",[60,587,588,591,594],{},[63,589,590],{},"Encrypting systems to halt daily operations.",[63,592,593],{},"Exfiltrating sensitive customer and intellectual property records to threaten public leaks.",[63,595,596],{},"Conducting distributed denial-of-service (DDoS) attacks or contacting company customers directly to accelerate\npayment.",[35,598,600],{"id":599},"infection-spread-lifecycle","Infection & Spread Lifecycle",[57,602,603],{},[60,604,605,623,633,639,645],{},[63,606,607,610,611,614,615,618,619,622],{},[24,608,609],{},"Initial Access Vector",": An employee opens a macro-enabled invoice (",[76,612,613],{},"Invoice_9042.docm","), a deceptive ZIP archive\ncontaining a disguised ",[76,616,617],{},".vbs"," or ",[76,620,621],{},".exe",", or attackers exploit exposed VPN\u002FRDP portals.",[63,624,625,628,629,632],{},[24,626,627],{},"Persistence & Defense Evasion",": The malware disables endpoint protection, clears Windows Volume Shadow Copies\n(",[76,630,631],{},"vssadmin delete shadows","), and establishes persistence.",[63,634,635,638],{},[24,636,637],{},"Lateral Movement & Domain Escalation",": Attackers harvest local credentials (using tools like Mimikatz), escalate\nto Active Directory Domain Admin, and locate all network storage (NAS\u002FSAN).",[63,640,641,644],{},[24,642,643],{},"Data Exfiltration",": Confidential databases, financial spreadsheets, and emails are compressed and quietly uploaded\nto anonymous cloud storage.",[63,646,647,650],{},[24,648,649],{},"Mass Encryption & Ransom Note",": Encryption scripts trigger simultaneously across domain servers and workstations,\nreplacing desktop wallpapers with ransom instructions.",[35,652,654],{"id":653},"simulated-ransom-note","Simulated Ransom Note",[20,656,657],{},[658,659],"img",{"alt":660,"className":661,"src":663,"title":660},"Ransomware screen example",[662],"w-full","\u002Fthreats\u002Fransomware-screen.webp",[111,665,669,672,675,678,697],{"channel":666,"icon":667,"sender":668},"Ransom Screen Notice","i-lucide-skull","BlackLock Ransomware Group",[20,670,671],{},"\"=== ATTENTION: ALL YOUR IMPORTANT FILES HAVE BEEN ENCRYPTED ===",[20,673,674],{},"All your corporate databases, documents, customer PII, and backups are locked with military-grade encryption algorithms.",[20,676,677],{},"To restore your systems:",[60,679,680,687,694],{},[63,681,682,683],{},"Download the Tor Browser from ",[181,684,685],{"href":685,"rel":686},"https:\u002F\u002Fwww.torproject.org",[185],[63,688,689,690],{},"Open our private portal: ",[181,691,692],{"href":692,"rel":693},"http:\u002F\u002Fblacklock5x9...onion",[185],[63,695,696],{},"Enter your Unique Client ID: 894F-29BC-EE01",[20,698,699],{},"PRICE: 4.5 BTC (Bitcoin). You have 72 hours before the decryption key is permanently deleted and all private files are\nreleased on the public darknet.\"",[35,701,147],{"id":146},[149,703,705],{"title":704},"Ransomware Resilience Rules",[153,706,707,713,719,725,731],{},[63,708,709,712],{},[24,710,711],{},"Maintain Immutable, Offline Backups (3-2-1-1-0 Rule)",": Ensure at least one full backup is physically disconnected\n(air-gapped) or stored in an immutable, write-once-read-many (WORM) cloud repository.",[63,714,715,718],{},[24,716,717],{},"Never enable macros or execute unexpected script attachments",": Office documents asking you to \"Enable Content\" or\n\"Enable Editing\" to view content are almost always weaponized droppers.",[63,720,721,724],{},[24,722,723],{},"Enforce the Principle of Least Privilege",": Standard employee accounts must not have local administrative rights on\ntheir machines.",[63,726,727,730],{},[24,728,729],{},"Isolate and patch remote access interfaces",": Never expose Remote Desktop Protocol (RDP) directly to the open\ninternet; mandate VPN with strict multi-factor authentication.",[63,732,733,736],{},[24,734,735],{},"Deploy Endpoint Detection & Response (EDR)",": Modern behavioral EDR tools can detect mass file modification and\nisolate the infected host automatically.",[35,738,740],{"id":739},"immediate-incident-containment","Immediate Incident Containment",[223,742,744],{"title":743},"Ransomware Detected? Take Instant Containment Actions",[153,745,746,752,758,764],{},[63,747,748,751],{},[24,749,750],{},"Disconnect immediately from physical networks",": Unplug ethernet cables and turn off Wi-Fi and Bluetooth on all\naffected devices immediately. DO NOT turn off the power (RAM holds crucial decryption keys and malware artifacts).",[63,753,754,757],{},[24,755,756],{},"Do not pay the ransom",": Cybersecurity authorities and law enforcement strongly advise against paying ransoms.\nPayment fuels criminal syndicates, does not guarantee data recovery, and marks your company as an easy repeat target.",[63,759,760,763],{},[24,761,762],{},"Isolate network segments and storage arrays",": Take offline network-attached storage and shared drives to stop\nencryption traversal.",[63,765,766,769],{},[24,767,768],{},"Contact certified forensic responders & law enforcement",": Engage certified incident response teams to secure\nforensic evidence and guide secure recovery from immutable backups.",[35,771,255],{"id":254},[153,773,774,782,789,796],{},[63,775,776,781],{},[181,777,780],{"href":778,"rel":779},"https:\u002F\u002Fwww.cisa.gov\u002Fstopransomware",[185],"CISA #StopRansomware"," – Official U.S. government guidance, threat alerts, and\nransomware playbooks.",[63,783,784,788],{},[181,785,787],{"href":262,"rel":786},[185],"Komerční banka – Škodlivý software a ochrana dat"," – Banking\nclient advisory on malware infections and prevention.",[63,790,791,795],{},[181,792,794],{"href":278,"rel":793},[185],"NÚKIB – Reakce na ransomware incidenty"," – National Cyber and Information Security Agency\nransomware defense guide.",[63,797,798,803],{},[181,799,802],{"href":800,"rel":801},"https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1486\u002F",[185],"MITRE ATT&CK – Technique T1486: Data Encrypted for Impact"," – Tactical\nbreakdown of ransomware encryption behaviors.",{"title":291,"searchDepth":292,"depth":292,"links":805},[806,807,808,809,810,811],{"id":571,"depth":292,"text":572},{"id":599,"depth":292,"text":600},{"id":653,"depth":292,"text":654},{"id":146,"depth":292,"text":147},{"id":739,"depth":292,"text":740},{"id":254,"depth":292,"text":255},"malware","Malicious software that encrypts vital business files, databases, and backup systems, demanding enourmous cryptocurrency ransoms under threat of permanent data destruction or public leaks.","i-lucide-lock-keyhole",{},"\u002Fthreats\u002Fransomware",{"title":565,"description":818},"Malicious software that encrypts vital business files, databases, and backup systems, demanding exorbitant cryptocurrency ransoms under threat of permanent data destruction or public leaks.",{"loc":816,"videos":820,"images":821},[],[],"ransomware","threats\u002F03.ransomware",[825,826,827,828],"Weaponized Attachments (PDF, Office macros, ZIP\u002FISO)","Drive-by Downloads","Compromised Remote Desktop (RDP)","Unpatched Software Vulnerabilities","7PQfpCikml7DgKVB8SCpY_YutgGtoDUW9hxpn2xPpzE",{"id":322,"title":323,"alias":324,"body":831,"category":302,"description":546,"extension":304,"gameScenarioLink":547,"gameScenarioTitle":548,"icon":549,"meta":978,"navigation":309,"path":551,"seo":979,"severity":312,"sitemap":980,"slug":556,"stem":557,"vector":983,"__hash__":562},{"type":9,"value":832,"toc":970},[833,835,843,847,849,851,882,884,886,892,894,898,922,924,926,946,948],[35,834,330],{"id":329},[20,836,837,336,839,341,841,345],{},[24,838,335],{},[338,840,340],{},[24,842,344],{},[20,844,348,845,352],{},[24,846,351],{},[35,848,356],{"id":355},[20,850,359],{},[57,852,853],{},[60,854,855,866,870,874,878],{},[63,856,857,379],{},[24,858,368,859,378],{},[24,860,861],{},[24,862,863],{},[181,864,377],{"href":375,"rel":865},[185],[63,867,868,385],{},[24,869,384],{},[63,871,872,391],{},[24,873,390],{},[63,875,876,397],{},[24,877,396],{},[63,879,880,403],{},[24,881,402],{},[35,883,109],{"id":108},[20,885,408],{},[111,887,888,890],{"channel":411,"icon":412,"sender":413},[20,889,416],{},[20,891,419],{},[35,893,423],{"id":422},[20,895,426,896,430],{},[24,897,429],{},[149,899,900],{"title":433},[153,901,902,906,910,914,918],{},[63,903,904,441],{},[24,905,440],{},[63,907,908,447],{},[24,909,446],{},[63,911,912,453],{},[24,913,452],{},[63,915,916,459],{},[24,917,458],{},[63,919,920,465],{},[24,921,464],{},[35,923,469],{"id":468},[20,925,472],{},[223,927,928],{"title":475},[153,929,930,934,938,942],{},[63,931,932,483],{},[24,933,482],{},[63,935,936,489],{},[24,937,488],{},[63,939,940,495],{},[24,941,494],{},[63,943,944,501],{},[24,945,500],{},[35,947,255],{"id":254},[153,949,950,955,960,965],{},[63,951,952,513],{},[181,953,512],{"href":510,"rel":954},[185],[63,956,957,521],{},[181,958,520],{"href":518,"rel":959},[185],[63,961,962,529],{},[181,963,528],{"href":526,"rel":964},[185],[63,966,967,537],{},[181,968,536],{"href":534,"rel":969},[185],{"title":291,"searchDepth":292,"depth":292,"links":971},[972,973,974,975,976,977],{"id":329,"depth":292,"text":330},{"id":355,"depth":292,"text":356},{"id":108,"depth":292,"text":109},{"id":422,"depth":292,"text":423},{"id":468,"depth":292,"text":469},{"id":254,"depth":292,"text":255},{},{"title":323,"description":546},{"loc":551,"videos":981,"images":982},[],[],[559,384,560,561],{"id":985,"title":986,"alias":987,"body":988,"category":302,"description":1201,"extension":304,"gameScenarioLink":1202,"gameScenarioTitle":1203,"icon":549,"meta":1204,"navigation":309,"path":1205,"seo":1206,"severity":312,"sitemap":1207,"slug":556,"stem":1208,"vector":1209,"__hash__":1214},"threats_cs\u002Fcs\u002Fhrozby\u002F02.vishing.md","Vishing (Hlasový phishing)","Podvodné telefonáty & podvržení čísla",{"type":9,"value":989,"toc":1193},[990,994,1006,1016,1020,1023,1059,1063,1066,1076,1080,1086,1122,1126,1129,1158,1162],[35,991,993],{"id":992},"co-je-to-vishing","Co je to Vishing?",[20,995,996,998,999,1001,1002,1005],{},[24,997,335],{}," (zkratka pro ",[338,1000,340],{},") je forma sociálního inženýrství prováděná prostřednictvím telefonních hovorů.\nNa rozdíl od běžného e-mailového phishingu, kde máte čas zkontrolovat podezřelé odkazy a odesílatele, vishing sází na\n",[24,1003,1004],{},"přímý psychologický nátlak v reálném čase",", autoritu volajícího a vyvolání paniky.",[20,1007,1008,1009,1012,1013,430],{},"Útočníci velmi často využívají technologii ",[24,1010,1011],{},"spoofingu telefonního čísla (Caller ID spoofing)",". Na displeji vašeho\ntelefonu se tak může zobrazit skutečné oficiální číslo vaší banky, klientského centra nebo Policie ČR. V pokročilých\npřípadech používají i ",[24,1014,1015],{},"klonování hlasu pomocí umělé inteligence (deepfake)",[35,1017,1019],{"id":1018},"jak-útočníci-postupují","Jak útočníci postupují",[20,1021,1022],{},"Útočník obvykle manipuluje obětí pomocí strachu, časového presu nebo předstírané snahy pomoci.",[57,1024,1027],{"description":1025,"title":1026},"Jak útočníci plánují a provádějí podvodný hovor krok za krokem.","Průběh typického vishingového útoku",[60,1028,1029,1035,1041,1047,1053],{},[63,1030,1031,1034],{},[24,1032,1033],{},"Příprava a sběr dat",": Podvodník získá základní informace z úniků dat nebo sociálních sítí (vaše jméno, banku,\ntelefonní číslo).",[63,1036,1037,1040],{},[24,1038,1039],{},"Podvržení telefonního čísla (Spoofing)",": Útočník nastaví VoIP ústřednu tak, aby vám na displeji zvonilo oficiální\nčíslo banky nebo policie.",[63,1042,1043,1046],{},[24,1044,1045],{},"Vyvolání paniky a ohrožení",": Volající tvrdí, že váš účet byl napaden, někdo si na vaše jméno bere úvěr, nebo vám\nhrozí zabavení peněz.",[63,1048,1049,1052],{},[24,1050,1051],{},"Instrukce k záchraně peněz",": Oběť je přesvědčena převést všechny úspory na tzv. „bezpečný záchranný účet“ nebo\nnainstalovat program pro vzdálenou správu (AnyDesk, TeamViewer).",[63,1054,1055,1058],{},[24,1056,1057],{},"Okamžité vyvedení financí",": Jakmile peníze odejdou nebo útočník získá přístup k obrazovce, finance jsou okamžitě\npřeposlány a vybrány přes síť bílých koní či kryptoautomaty.",[35,1060,1062],{"id":1061},"ukázka-podvodného-hovoru","Ukázka podvodného hovoru",[20,1064,1065],{},"Takhle zní reálný scénář, se kterým se dnes setkávají tisíce lidí v České republice:",[111,1067,1070,1073],{"channel":1068,"icon":412,"sender":1069},"Telefonní hovor","\"Bezpečnostní oddělení banky\" (Falešný hovor)",[20,1071,1072],{},"„Dobrý den, pane Nováku, tady bezpečnostní technik z centrály vaší banky. Zaznamenali jsme podezřelý pokus o schválení\núvěru na 250 000 Kč z pobočky v Brně. Jste to vy?",[20,1074,1075],{},"Ne? V tom případě byl váš účet zkompromitován. Abychom zablokovali další transakce, musíte mi nadiktovat 6místný\nautorizační kód, který vám právě dorazil SMS zprávou. Nezavěšujte, jinak banka nemůže nést odpovědnost za ztrátu peněz!“",[35,1077,1079],{"id":1078},"jak-se-účinně-bránit","Jak se účinně bránit",[20,1081,1082,1083,430],{},"Základní bezpečnostní pravidlo zní: ",[24,1084,1085],{},"Nikdy neověřujte pravost volajícího v rámci téhož příchozího hovoru",[149,1087,1090],{"description":1088,"title":1089},"Ověřené zásady, které vás spolehlivě ochrání před podvodníky.","Desatero obrany proti vishingu",[153,1091,1092,1098,1104,1110,1116],{},[63,1093,1094,1097],{},[24,1095,1096],{},"Zavěste a zavolejte zpět sami",": Pokud vám volá bankéř nebo policista a řeší bezpečnostní incident, hovor ukončete.\nVytočte oficiální číslo banky uvedené na zadní straně vaší platební karty nebo na oficiálním webu.",[63,1099,1100,1103],{},[24,1101,1102],{},"Banka po telefonu nikdy nechce PIN ani hesla",": Žádný zaměstnanec banky od vás nikdy nebude žádat heslo do\ninternetového bankovnictví, PIN ke kartě, CVC kód ani potvrzení v bankovní aplikaci pro „zrušení operace“.",[63,1105,1106,1109],{},[24,1107,1108],{},"Neexistuje žádný „bezpečný záchranný účet“",": Banky nikdy neinstruují klienty k převodu peněz na účet rezervního\nfondu nebo do cizí banky za účelem záchrany.",[63,1111,1112,1115],{},[24,1113,1114],{},"Neinstalujte žádný software pro vzdálený přístup",": Programy jako AnyDesk, TeamViewer nebo RustDesk umožňují\nútočníkovi plnou kontrolu nad vaším počítačem nebo telefonem.",[63,1117,1118,1121],{},[24,1119,1120],{},"Nenechte se vmanipulovat do časového stresu",": Nátlak a hrozba okamžité ztráty peněz je nejčastějším varovným\nsignálem manipulace.",[35,1123,1125],{"id":1124},"co-dělat-pokud-jste-naletěli","Co dělat, pokud jste naletěli",[20,1127,1128],{},"Pokud jste sdělili své přístupové údaje, potvrdili autorizaci nebo odeslali platbu:",[223,1130,1132],{"title":1131},"Byl\u002Fa jste terčem útoku? Jednejte okamžitě",[153,1133,1134,1140,1146,1152],{},[63,1135,1136,1139],{},[24,1137,1138],{},"Ihned kontaktujte klientskou linku své banky",": Požádejte o okamžitou blokaci platebních karet, zablokování\ninternetového bankovnictví a pokuste se o storno odchozích plateb.",[63,1141,1142,1145],{},[24,1143,1144],{},"Odpojte počítač nebo telefon od internetu",": Pokud jste instalovali jakoukoli aplikaci na pokyn útočníka, odpojte\nWi-Fi i mobilní data, aby útočník ztratil spojení.",[63,1147,1148,1151],{},[24,1149,1150],{},"Nahlaste incident Policii ČR",": Podejte trestní oznámení. Uchovejte si historii volání, čas hovoru, číslo účtu, na\nkterý jste poslali peníze, a veškerou SMS komunikaci.",[63,1153,1154,1157],{},[24,1155,1156],{},"Upozorněte firemní IT oddělení",": Týká-li se incident firemních zařízení nebo hesel, neprodleně informujte své\nfiremní IT\u002FCSIRT specialisty.",[35,1159,1161],{"id":1160},"zdroje-a-doporučená-literatura","Zdroje a doporučená literatura",[153,1163,1164,1170,1178,1186],{},[63,1165,1166,1169],{},[181,1167,512],{"href":262,"rel":1168},[185]," – Doporučení\nbanky k ověřování identity volajícího a ochraně úspor.",[63,1171,1172,1177],{},[181,1173,1176],{"href":1174,"rel":1175},"https:\u002F\u002Fwww.kybertest.cz\u002F",[185],"Česká bankovní asociace – Kampaň #NePINdej!"," – Celonárodní vzdělávací projekt o nástrahách\nkybernetického podvodu a sociálního inženýrství.",[63,1179,1180,1185],{},[181,1181,1184],{"href":1182,"rel":1183},"https:\u002F\u002Fwww.policie.cz\u002F",[185],"Policie ČR – Pozor na falešné bankéře a policisty"," – Výstrahy před organizovanými\nvishingovými skupinami v České republice.",[63,1187,1188,1192],{},[181,1189,1191],{"href":534,"rel":1190},[185],"MITRE ATT&CK – Technika T1566.004: Spearphishing Voice"," –\nMezinárodní klasifikace hlasových útoků.",{"title":291,"searchDepth":292,"depth":292,"links":1194},[1195,1196,1197,1198,1199,1200],{"id":992,"depth":292,"text":993},{"id":1018,"depth":292,"text":1019},{"id":1061,"depth":292,"text":1062},{"id":1078,"depth":292,"text":1079},{"id":1124,"depth":292,"text":1125},{"id":1160,"depth":292,"text":1161},"Podvodné telefonní hovory, při kterých se útočníci vydávají za bankéře, policisty nebo IT podporu. Pomocí psychologického nátlaku a podvrženého telefonního čísla se snaží vylákat peníze nebo přístupové údaje.","https:\u002F\u002Fplay.cyber-framework.net?scenario=vishing","Operace Hlasová past",{},"\u002Fcs\u002Fhrozby\u002Fvishing",{"title":986,"description":1201},{"loc":1205},"cs\u002Fhrozby\u002F02.vishing",[1210,1211,1212,1213],"Telefonní hovor (Voice)","Podvržení čísla (Caller ID Spoofing)","Hlasové deepfakes","Sociální inženýrství","cjFSnauqzXPDQ2gIFxmpwAbvWhVCq7X-2r0PE7mZfN0",[1216,1217],{"title":6,"path":310,"stem":315,"description":303,"children":-1},{"title":565,"path":816,"stem":823,"description":813,"children":-1},1792020367389]