Phishing attacks abusing SaaS platforms see a massive 1,100% growth
Threat actors are increasingly abusing legitimate software-as-a-service (SaaS) platforms like website builders and personal branding spaces to create malicious phishing websites that steal login credentials.
According to a new report by Palo Alto Networks Unit 42, researchers have seen a sharp rise in this abuse, with the data collected by the firm showing a massive increase of 1,100% from June 2021 to June 2022.
The advantages of using SaaS for phishing include evading alerts from email security systems, enjoying high availability, and bypassing the need to learn how to code to create websites that appear legitimate.
Also, because SaaS platforms simplify and streamline the process of creating new sites, phishing actors can easily switch to different themes, scale up or diversify their operations, and quickly respond to reports and takedowns.
Unit 42 has divided the abused platforms into six categories: file sharing and hosting sites, form and survey builders, website builders, note-taking and documentation writing platforms, and personal portfolio spaces.
Palo Alto Networks filtering systems recorded a growth in the abuse across all categories, but the most significant were website builders, collaboration platforms, and form builders.
Also, the stats indicate a notable rise in October 2021, based mainly on the sudden uptick in the abuse of form builders.
In 2021, Cyren reported about the rampant abuse of “typeform.com” for phishing, an older report from Trend Micro mentioned “123formbuilder.com”, “formtools.com”, and “smartsurvey.co.uk”, while Cofense highlighted the abuse of “Canva.com”. Around the same time, another uptick was spotted, augmented by the abuse of a personal branding site the report doesn’t name.
Stopping the abuse of legitimate SaaS platforms will be very hard, as implementing aggressive email filters against those services isn’t a choice.
That’s precisely what makes them so suitable for phishing campaigns and why the rise in its abuse since last year has been so startling.
If a message that makes bold claims or requests urgent action from you lands in your inbox, avoid clicking embedded links or buttons, but instead use a search engine to locate the official site of the potentially spoofed platform.
Whenever you’re requested to enter your account credentials, ensure that you are on the legitimate website URL before you start typing in the form boxes.
With thanks to the Cyber Defence Alliance and BleepingComputer. The full story is here: https://www.bleepingcomputer.com/news/security/phishing-attacks-abusing-saas-platforms-see-a-massive-1-100-percent-growth/
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW