How to Stay Safe During Holiday Season: Key Security Points to Check Now

During the holiday season, reduced staffing and slower response times create favorable conditions for cyberattacks. Threat actors take advantage of this period to launch coordinated campaigns that combine phishing, smishing, credential theft, and ransomware, targeting both organizations and individual users. Recent large-scale data breaches further demonstrate how quickly these attacks can escalate, reinforcing the need for heightened security awareness and preparation.

1. Major Cyber Threats and Risk Factors

1) Phishing and Spear Phishing

Phishing attacks use convincing messages to lure users into clicking links or entering information. During the holiday season, topics such as donations, and expiring reward points are commonly used, making it easier for attackers to bypass user caution. Targeted spear phishing attacks aimed at executives or finance and HR personnel can lead to rapid and widespread damage due to elevated account privileges.

• Increase in emails impersonating delivery notices, point expiration alerts, and donation receipts
• Continued targeted spear phishing impersonating executives and finance or HR personnel
• Initial access attempts through malicious links or attachments
• Growing use of customized attacks leveraging previously leaked personal information

2) Smishing (SMS Phishing)

Smishing attacks frequently use messages that prompt quick responses and lead users to click links without verification. These messages often reference delivery issues, government benefits, or refunds. Clicking the links can result in malicious app installation or credential theft. 

• Distribution of SMS messages disguised as delivery issues, government benefits, holiday-related offers, or refunds
• Inclusion of URLs designed to install malicious applications or steal account credentials
• Use of legitimate organization or company names to increase credibility 

3) Ransomware and Infostealers

Ransomware attacks increasingly go beyond file encryption and often involve data theft followed by extortion. Infostealers are commonly used to collect credentials and system information before or alongside ransomware deployment. Attacks launched during nights, weekends, or holidays can cause greater damage due to delayed detection and response. 

• Increase in attacks targeting nights, weekends, and holiday periods
• Credential theft via compromised cloud or VPN accounts followed by lateral movement
• Targeting backup servers and file servers to maximize impact 

4) Messenger Impersonation and Payment Fraud

As business communication increasingly relies on messaging platforms, impersonation scams using these continue to grow. Attackers often pose as internal staff and send urgent messages such as payment request or transfers to bypass normal verification steps. When a messenger account is compromised, attackers may mimic existing conversation patterns to appear legitimate. 

• Fraudulent payment requests via business messengers such as WhatsApp, and Teams
• Impersonation of internal employees or partners following email or messenger account compromise

2. Security Guidelines for Employees and Users

Many security incidents begin with simple human error rather than technical failure. During the holiday season, increased workload and absences can weaken basic security practices. The following guidelines outline essential actions that users can take immediately.

1) Handling Email, SMS, and Messenger Messages

Phishing messages often succeed because a single lapse in attention is enough to trigger a click or file execution. When in doubt, reporting suspicious messages is more effective than attempting to assess them individually. Users should immediately delete messages if the sender’s address or phone number differs from the legitimate source, verify URLs before clicking links, and keep in mind that government agencies and financial institutions do not send URLs via SMS. Executable files, compressed files or documents containing macros should never be opened, and any suspicious messages should be reported to the security team without delay.

2) Strengthening Account Security

User accounts remain the most common entry point for attackers. Weak security practices, such as password reuse or the absence of multi-factor authentication, can quickly lead to account takeover. Passwords should be changed regularly and must not be reused across services. Multi-factor authentication should be enabled wherever possible, and MFA approval requests that were not initiated by the user should never be approved.

3) Endpoint Device Management

Endpoints are the primary locations where business data is accessed and stored. Delayed patching, unnecessary software, and the use of unauthorized external storage devices significantly increase the risk of infection. Operating systems and security software should be kept fully up to date, unused programs should be removed, personal USB devices should not be used for work purposes, and device locking and loss prevention measures should be strictly enforced, particularly during travel. 

3. Recommendations for Administrators (IT and Security Teams)

For administrators, prevention alone is not sufficient. Detection capability and response speed largely determine the scale of damage. External-facing assets, account activity, and backup systems should be prioritized during the holiday period.

1) System and Network Security Checks

Systems accessible from the internet are typically the first targets scanned by attackers. Weak authentication controls or delayed patching can lead to Credential theft and subsequent lateral movement within the environment. Patching should therefore be prioritized for externally accessible systems such as VPNs, Citrix environments, and web servers. Detection capabilities for repeated login failures and anomalous access patterns, including overseas login attempts, should be strengthened, and audit logs for critical systems such as Active Directory and backup servers should be reviewed on a regular basis. 

2) Backup and Recovery Readiness

Backup systems must be prepared for potential ransomware or destructive attacks. Offline or segmented backups should be kept up to date, the integrity of backup data should be verified, and recovery procedures should be validated in advance using documented runbooks to ensure that restoration can be performed quickly when needed. 

3) Cloud and SaaS Security

Cloud and SaaS environments depend heavily on account and permission management, making them attractive targets after initial compromise. Excessive privileges, publicly shared links, and OAuth approvals can all be abused by attackers. Administrators should review and reduce unnecessary IAM permissions, audit publicly shared links and enforce expiration policies, and strengthen monitoring for OAuth-based phishing and unauthorized application approvals. 

4. Incident Response Procedures

Accurate initial response is critical to preventing secondary damage. Deleting files or rebooting systems can erase evidence needed for investigation. The recommended approach is to contain, report, and investigate in sequence.

Suspicious files or URLs should not be deleted and should be reported immediately. Systems suspected of infection should be disconnected from the network. If account compromise is suspected, passwords should be changed immediately and MFA should be re-registered. Any suspicious internal or external communications should be shared promptly.

5. Incident Reporting

Accurate initial response is critical to preventing secondary damage. Actions such as deleting files or rebooting systems can remove evidence needed for investigation and should be avoided. The recommended approach is to first contain the threat, then report it, and finally proceed with investigation. Suspicious files or URLs should not be deleted and must be reported immediately. Systems suspected of infection should be isolated from the network, and if credential compromise is suspected, passwords should be changed immediately, and MFA should be re-registered. Suspicious internal or external communications should be shared without delay to ensure coordinated response.