October is a time for spooky decorations, fun costumes, and candy...not destructive cyberattacks. Yet that's what started up in October 2021 - a new "vishing" attack spreading fast.

Vishing, or 'voice phishing,' adds another element to the typical phishing attack—voice messages.

Ordinarily phishing messages come via email. You get a message that looks like it came from your bank, or a software company, asking you to click a link. The link leads you to malware, which sets off the whole cyberattack.

However, this latest vishing campaign doesn't use a link. It uses a phone number.

Here's how it works, according to ArmorBlox, who discovered the campaign:

1. You receive an email that looks like it comes from Microsoft.

2. It contains an invoice for renewing "Microsoft Defender." Wait a minute...you didn't renew Defender (it's free, by the way).
3. Well, the invoice has a phone number for "any questions you may have." So you call the number.
4. On the phone, someone who says they're "from Microsoft" asks you to download some software to "verify"' the renewal.
5. The software allows remote access to your computer. Once you download & run it, they're in.
6. Now they can steal your data, deploy ransomware, crash the network…whatever they want. Cyberattack commences.

Why incorporate a phone call? It increases the "trust factor." It's easy to delete an email you didn't expect. Talking to someone on the phone, who says they want to help you with an issue, makes it easier to trust them.

That's what makes vishing so dangerous.

How do you stop this from hurting you? Exercise caution, and follow some simple practices:

• Whenever you receive an unexpected message, especially involving bills, check with your billing department. If they didn't expect the message either, notify your IT department.
• Watch for phishing 'cues.'
  • Lots of links in an email (or no links at all, even in the footer).
  • Misspelled words.
  • A Gmail address used for an 'official business' email.
  • Inconsistencies with names, addresses, or email addresses.
• Search the phone number before calling. If it doesn't match up to the business' official numbers, chances are it's fake.
• If you receive a call you don't recognize, and they ask you to download something to your computer? Hang up and notify IT Support.