At URL Pro we understand that information is our most valuable asset. While absolute risk always lurks, our commitment is to help reduce it to its bare minimum. Welcome to Riesgo Zero, the space where we learn to protect what makes us great.
Information security in Latin America: a call to action
The region faces double the cyberattacks of the United States, with over 3,000 weekly attacks directly affecting companies and organizations — driven by digitalization growth that is today outpacing the maturity of cybersecurity.
The most common attacks
- Phishing
- Social engineering
- Banking malware
- Credential theft
- Botnets
Email remains the main entry point: 74% of cases start there.
Time to strengthen capabilities
- Security culture: fostering a vigilant mindset.
- Active defense strategies: implementing proactive defenses and monitoring.
- Training and raising staff awareness: good practices for data protection.
What social engineering is
Social engineering is psychological manipulation used to obtain information or access.
- 1
1. Reconnaissance (research)
Gathering data on the victim: social media, company, interests.
- 2
2. Developing the deception (building trust)
Creating a convincing story or pretext to approach the victim.
- 3
3. Exploitation (psychological manipulation)
Using emotions like urgency, curiosity, fear, or the desire to help.
- 4
4. Execution (theft or access)
Getting the victim to reveal passwords, data, or install malware.
Common methods: phishing, smishing, vishing, baiting, and quid pro quo.
- Verify identity
- Be wary of urgent requests
- Don't share credentials
- Security training
What phishing is
Phishing is the art of deceiving people to steal credentials and data.
- 1
1. Creating the deception (design and targeting)
Creating a fake email, SMS, or website that looks legitimate and appealing.
- 2
2. Sending and delivery (distribution)
Sending mass or targeted messages (spear phishing) through various channels.
- 3
3. The victim takes the bait (deception and action)
Using urgency or fear tactics to get the victim to click or open a file.
- 4
4. Data theft (harvesting)
Collecting access credentials, financial data, or installing malware on the device.
Common phishing methods: email, spear phishing, smishing (SMS), vishing (voice), and pharming.
- Verify identity (links and senders)
- Be wary of urgent requests
- Don't share credentials
- Security training and awareness
What smishing is and how it works
- 1
1. Sending the fake SMS
The attacker sends a mass SMS impersonating a trusted entity (e.g., a bank, courier, or prize).
- 2
2. Creating urgency and fear
The message has an urgent tone, threats, or promises, to prompt a quick action without thinking.
- 3
3. The link/URL trap
The victim clicks the link, which leads to a fraudulent webpage designed to steal credentials or personal data.
- 4
4. Data theft and fraud
Once the data is entered, the attacker takes over accounts, steals identity, or commits financial fraud.
What vishing is and how it works
- 1
1. Setup and data gathering
The attacker researches victims or uses leaked lists to find contacts.
- 2
2. The initial call and the pretext
Calls the victim pretending to be a trusted entity (bank, tech support, etc.).
- 3
3. Social engineering and manipulation
Uses urgency, fear, or sympathy tactics to build trust and persuade: "Act now or lose access!"
- 4
4. The trap and the final fraud
The victim is directed to a fake website or tricked into revealing credentials, PINs, or security codes (MFA).
What baiting is and how it works
- 1
1. The bait
An attacker leaves a physical object (USB, SD card) or a link to a file in a strategic, high-visibility spot.
- 2
2. Curiosity and greed
The victim finds the bait. Curiosity or the desire for a benefit drives them to interact with it.
- 3
3. The victim's action
By connecting the device or opening the file, malware runs or a malicious website opens.
- 4
4. Data theft and final fraud
The attacker takes control of the system, steals sensitive information, or installs ransomware. The company is compromised.
- Training: teach people not to connect unknown devices.
- Physical security: control access to common areas.
- Technology: disable Autorun on devices.
What quid pro quo is and how it works
- 1
1. The fake offer
An attacker offers a legitimate-seeming service or benefit in exchange for something, often posing as technical support.
- 2
2. Manipulating the benefit
The victim believes the offer is genuine and valuable, feeling inclined to accept the help.
- 3
3. The victim's action
By accepting, the victim provides information or access (e.g., credentials, PIN, remote access) believing it is necessary for the service.
- 4
4. Data theft and final fraud
The attacker takes control of the system, steals sensitive information, or installs malware. The company is compromised.
Thank you for joining us today. Social engineering keeps evolving, but a preventive culture built on clear protocols is the best defense. Together we strengthen our companies' organizational resilience.
URL Pro Security Officer
