How can I tell if an email is a phishing attack?

Key red flags for phishing emails include: the sender domain does not match the organization it claims to represent (check the full email address, not the display name); the email creates artificial urgency; the link URL on hover does not match the expected destination; the message requests unusual actions like wire transfers, password resets, or disabling security controls; and requests for secrecy or bypassing normal approval processes.

Are Saudi government portals like Absher used in phishing attacks?

Yes. Threat actors regularly create pixel-perfect clones of Saudi government portals including Absher and Saudi.gov.sa, hosting them on lookalike domains such as absher-verify.sa or absher-update.com. Saudi government portals will never send unsolicited emails asking you to click a link to verify your credentials. Always navigate directly to official .gov.sa domains in your browser rather than following email links.

What is Business Email Compromise (BEC) and how does it target Saudi organizations?

Business Email Compromise (BEC) is a type of social engineering attack where attackers impersonate a senior executive — typically the CEO or CFO — and instruct the finance team to urgently process a wire transfer. In Saudi Arabia, BEC attacks are often timed around M&A activity, end-of-quarter, or public events. Attackers research the company via LinkedIn and public sources to craft convincing, contextually accurate messages. BEC costs Saudi organizations hundreds of millions of riyals annually.

What is vishing and is it happening in Saudi Arabia?

Vishing (voice phishing) is a social engineering attack conducted over phone calls. In Saudi Arabia, threat actors are increasingly using AI-powered voice synthesis to clone executive voices using audio from public interviews, YouTube videos, or conference recordings. The synthetic voice calls employees to request urgent actions such as OTP codes, account access, or fund transfers. Establish a call-back verification procedure using known phone numbers for all out-of-process executive requests.

Phishing Attacks Targeting Saudi Employees: Real Examples & How to Spot Them

Phishing remains the most common initial access vector for cyberattacks in Saudi Arabia. Threat actors have moved well beyond generic "reset your password" emails — today's campaigns are Arabic-language, deeply contextual, and Saudi-specific, referencing real government portals, legitimate business events, and local compliance deadlines.

The following attack patterns are based on campaign activity observed across the Saudi private and public sector. Specific names and organizations are anonymized, but the techniques are real and active.

What Types of Phishing Attacks Target Saudi Employees?

⚠ Spear Phishing · Government Portal Impersonation

Fake Absher / Saudi.gov.sa Credential Harvesting

Employees receive an email in Arabic claiming their Absher account has been flagged for unusual activity and must be verified within 48 hours. The link leads to a pixel-perfect clone of the Absher login page hosted on a domain such as absher-verify[.]sa or absher-secure[.]net. Harvested credentials are used to access government services and enable corporate account takeover.

🚩 Red flags: Non-.gov.sa domain, artificial urgency, generic salutation, no official reference number

⚠ Business Email Compromise (BEC) · Finance Targeting

CEO / CFO Wire Transfer Fraud

An email appearing to come from the CEO's personal Gmail or a spoofed corporate domain asks the finance team to process an urgent, confidential wire transfer — often timed to coincide with real M&A activity, Ramadan, or end-of-quarter periods. The attacker has researched the company via LinkedIn and public announcements to craft a convincing, contextually plausible message. BEC fraud costs Saudi organizations hundreds of millions of riyals annually.

🚩 Red flags: Personal email for internal corporate requests, demands for secrecy, bypassing normal approval channels, unusual payment destination

⚠ Smishing · HR & Payroll Impersonation

Fake GOSI / HRDF / Ministry of Human Resources Notifications

SMS messages claiming to be from GOSI, HRDF, or the Ministry of Human Resources instruct employees to update banking details or lose their social insurance benefits. The link leads to a spoofed portal designed to collect national ID numbers, IBAN details, and passwords. Campaigns spike during salary cycles, Eid periods, and benefit renewal deadlines — when employees are most likely to act quickly.

🚩 Red flags: SMS from unknown short code or mobile number, link to non-official domain, requests for IBAN or national ID via mobile link

⚠ Vishing · AI Voice Synthesis

AI-Synthesized Executive Voice Calls

Attackers scrape audio from public interviews, investor calls, or YouTube videos and use AI voice synthesis tools to clone an executive's voice. The synthetic voice calls an employee directly, instructing them to share a one-time password, purchase gift cards, or disable a security control. This technique is increasingly accessible, difficult to detect aurally, and growing in Saudi Arabia's executive-heavy corporate culture.

🚩 Red flags: Unexpected call requesting out-of-process actions, refusal to use official channels, subtle robotic pauses, urgency preventing callback

How Do You Identify a Phishing Email? Red Flags to Check

How Can Saudi Organizations Defend Against Phishing?

A layered technical and human defense is the only reliable protection against phishing campaigns:

Frequently Asked Questions: Phishing in Saudi Arabia

The most common phishing attacks targeting Saudi employees are: (1) fake Absher or Saudi.gov.sa credential harvesting pages, (2) Business Email Compromise (BEC) targeting finance departments with fraudulent wire transfer requests, (3) SMS phishing (smishing) impersonating GOSI or HRDF portals to steal IBAN and national ID details, and (4) AI-synthesized voice calls (vishing) impersonating executives.

Yes. Threat actors create pixel-perfect clones of Absher and other Saudi government portals, hosted on lookalike domains. Saudi government portals will never send unsolicited emails asking you to click a link to verify your credentials. Always navigate directly to official .gov.sa domains in your browser.

Business Email Compromise (BEC) impersonates a senior executive to trick the finance team into making urgent wire transfers. In Saudi Arabia, attackers time campaigns around Ramadan, end-of-quarter, or M&A announcements and research targets via LinkedIn. BEC costs Saudi organizations hundreds of millions of riyals annually. The defense is a mandatory call-back verification procedure for all wire transfer requests.

Yes. Attackers use publicly available audio to clone executive voices using AI tools, then call employees directly to request OTPs, gift cards, or security bypass actions. This technique is growing rapidly. Establish code-word verification or mandatory video-call confirmation for any unusual executive request received by phone.

GHS runs simulated phishing campaigns tailored to the Saudi context — Arabic-language lures, Absher and government portal spoofs, BEC scenarios, and GOSI smishing simulations — to benchmark employee awareness and measure improvement over time. Contact GHS for a phishing simulation proposal.