Deceptive Links, Brand Impersonation, and Identity Deception Top the List of Phishing Attack Tactics
As phishing attacks continue to dominate as an initial attack vector, new data shows that attackers maintain the use of tried-and-true techniques as the means to successful attacks.
Cloud security company Cloudflare has a ton of visibility into threats of all kinds – including email. They analyzed 13 billion emails that were sent From May 2022 to May 2023 to look for commonalities in threats. The result is their first ever 2023 Phishing Threats Report. According to the report, the analysis showed that threat actors continue to use the same techniques (because they continue to work) to trick victims into giving up credentials, downloading and opening files, and more.
Some of the top threats included deceptive links, brand impersonation, and identity deception.
Deceptive Links appeared in nearly 36% of all phishing attacks. These include links that purport to display Office documents, start the digital signing of contracts, and more. Brand Impersonation included over 1000 known brands, with over half of all attacks zeroing in on just 20 brands including Microsoft, Google, Apple, Amazon, and more. Identity Deception (i.e., the impersonating of an individual – commonly referred to as business email compromise – to increase the likelihood of the victim opening and interacting with the email) occurred in 14% of attacks – a surprisingly low number, given that all that’s needed is a little diligence to identify the right identity and changing the sender display name to match.
It’s frustrating that these basic methods continue to reap rewards for cybercriminals, when users should be educated by now through Security Awareness Training to spot these techniques and report them without harmful engagement that puts the organization at risk. If your organization continues to see attacks make their way past the user, it’s time to get them educated.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW