Researchers Warn of Surge in Infostealers Delivered Via Phishing
The number of infostealers delivered via phishing emails increased by 84% last year, according to a new report from IBM’s X-Force researchers. Threat actors are using these malware strains to steal credentials for use in follow-on attacks.
“Year-over-year, X-Force is seeing a rise in infostealers delivered via phishing emails and credential phishing,” the report says. “Both result in active credentials that may be used in follow-on, identity-based attacks.
Phishing has emerged as a shadow infection vector for valid account compromises. By clicking on links that seem legitimate, users can unknowingly open the door to infostealer malware that siphons sensitive data from victims. Because adversaries hide and deliver malware payloads more cleverly, it can take longer to detect ransomware and data breaches.”
The surge in infostealer malware is driving a rise in abuse of valid accounts. Attackers obtain login credentials via malware or credential phishing, and simply log into legitimate accounts.
“Identity-based attacks make up 30% of total intrusions,” the report says. “For the second year in a row attackers adopted more stealthy and persistent attack methods, with nearly one in three attacks that X-Force observed using valid accounts. A surge in phishing emails distributing infostealer malware and credential phishing fuels this trend, which may be attributed to attackers leveraging AI to scale attacks.”
The researchers conclude that employee education can provide an important layer of defense against attacks.
“Keep your employees current on the most effective security practices,” IBM says. “Educate your employees about the risks associated with phishing attacks and poor password hygiene and regularly update your people about ways to protect themselves and your organization.”
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
IBM has the story.
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser:https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW