Google Phishing Pages Jump 1,560% YoY
Vade has released a report looking at phishing trends in 2022. The researchers say the top three most-impersonated brands last year were Facebook, Microsoft, and Google.
“For the second consecutive year, Facebook was the top impersonated brand, edging out Microsoft,” the researchers write. “With more than 25,000 unique branded phishing websites—Facebook represented nine percent of total phishing from this year’s list. Microsoft finished as runner-up for the second year in row, also representing nine percent of all phishing websites but accounting for nearly 2,000 less than Facebook. Like 2021, Microsoft remains the most impersonated brand in the corporate market. Google jumped into the #3 spot with 1,560 percent YoY growth in phishing pages, the second biggest leap among brands to crack the top 20 in this year’s report.”
The researchers explain that the growing popularity of Google’s productivity suite accounts for the meteoric rise in Google-themed phishing pages.
“Productivity suites are an attractive target for phishers,” Vade says. “With a suite of integrated applications, these digital ecosystems give phishers more opportunities to exploit users before and after an initial compromise. For example, phishers can impersonate integrated applications such as file-sharing solutions in an initial attack, as well as use compromised accounts to distribute malicious links and files through new channels, such as instant messaging tools.”
The report also found that phishing attacks are becoming more targeted and attackers are increasingly abusing legitimate services to evade detection.
“One example surfaced earlier this year when a French career website was targeted by phishers, who applied to job openings with resumes containing phishing links,” the researchers write. “With each application submitted, the career platform auto generated a response email that delivered the malicious resumes to recruiting organizations. Once victims open the PDF resume attachments, they’re prompted to click malicious links that point to a phishing website, where hackers can harvest account credentials. The attack exploits the legitimate servers, IP address, and domain name of the website, making it more difficult for email filters and victims to detect.”
New-school security awareness training can teach your employees to follow security best practices so they can avoid falling for social engineering attacks.
Vade has the story.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW