Multi-Medium Phishing Tactics Increase Attack Effectiveness by 300%
New data from IBM shows how attackers are leveraging more than just email to elevate their chances of reaching their malicious goals – and their victims are helping them do it.
I’ve covered attacks that leverage voice and email as attack mediums before; they’re not new. But never before have I seen data suggesting just how impactful these attacks really are. According to new data from the IBM Security X-Force Threat Intelligence Index 2022 Full Report, attacks that use voice and email materially increase an attacker’s chances of success.
According to the report, 41% of attacks exploited phishing for initial access – a 24% increase over the previous year. And with a little more than a third of these phishing attacks comes vulnerability exploitation – no doubt taken advantage of by malware.
What’s most interesting in this report is the findings around adding phone calls to email-based phishing attacks. While email-only attacks only netted a 17.8% click rate, those attacks that also used a voice call (so, vishing) resulted in a 53.2% click rate – tripling the engagement of potential victims (and also somewhat indicating a higher likelihood of success, as victims are willing to engage a given scam over two mediums.)
So, it seems that cybercriminals are dialing in on the recipe for success – finding a mix of voice, phishing, and vulnerability exploits that, in sum total, give them the greatest opportunity to achieve their malicious goals.
But because phishing and vishing are material factors in this equation, social engineering is necessary – something that can be easily thwarted by Security Awareness Training that educates users to be vigilant around unsolicited communications, always being on guard when being asked to engage with attachments, links, and queries for information not regularly shared.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW