Suppose an employee needs to log into his company’s payroll system. Instead of using a bookmark or a password manager, he searches Google for the login page and clicks a sponsored ad near the top of the results.
The ad’s domain looks almost identical to the real one (for example, quickboks.com instead of quickbooks.com). In this example, there’s a missing letter. In other cases, two letters might be swapped. This is easy to miss at a glance and could happen with any login page, not just one particular platform.
If the fake page captures the employees username, password, and MFA code, an attack bot could use that information to immediately log into the real site. From there, hackers could access payroll records or redirect direct deposits.
For users who work with the same systems regularly, familiarity can breed carelessness. The reality is that nobody reads every character of every URL.
Tell your users: stop searching for your login pages.
Search engines are not a safe way to navigate to a site you log into, because sponsored ads with look-alike domains can be bought by anyone. Once you land on a fake page, everything about it can look right, including the layout, the branding, and even the padlock icon. The only thing wrong is the domain, which is easy to miss if you are not checking for it every time.
Bookmark the login pages you use regularly. Better yet, use a password manager. A good password manager will only autofill credentials on the correct domain and won’t fill them on a lookalike site.
A few other habits to add:
- Where it’s available, use passkeys or FIDO2 security keys instead of a password. These are built to resist this exact kind of attack by working only with the verified domain.
- Monitor your accounts for unauthorized changes, such as a redirected direct deposit or a login from an unfamiliar location. This is often the first sign of a breach after credentials have been stolen.
Ask us how cybersecurity training and SASE protection can help defend against these kinds of breaches.
