Phishing isn’t exactly a new kid on the block. Phishing is one of the most common email-based threats. It is a tried and tested tactic that continues to deliver impressive results for cybercriminals. That’s why phishing continues to grow in popularity. In the month of June 2014 alone, phishing activities totaled $400 million in losses, which could be annualized at $102 million per year.
While it has been around for years, phishing has evolved considerably and has increased in efficiency and effectiveness. In the last six months (as compared to 2013), we’ve seen several differences in the type, size and sophistication of phishing attacks. In this post, we’ll explore the notable differences in the modern phish and discuss new phishing trends that we have seen in 2014 thus far.
#1: There has been an increase in application-targeted attacks.
One of the primary trends that we are seeing in the phishing space, are attacks directed at commonly-used applications like Google Docs, Gmail or Yahoo. In the past, we saw a lot of big brands being attacked. However, today’s criminals are now going after things that are not directly related to the target company. The reason for this is the prevalence of password reuse. While large banks have improved their phishing defenses, personal email accounts provide a channel through which cybercriminals can gain access to individual bank accounts.
This trend is not limited to email programs, however. Considering that financial institutions have increased their defenses, cybercriminals are looking elsewhere and are diversifying their attacks. File sharing websites like Dropbox are major targets, as cybercriminals are able to use bogus links to intercept usernames and passwords. There has also been an increase in attacks targeting industries such as gaming, logistics and travel.
#2: Smaller brands are now being targeted.
While large brands still get a lot of attention, small brands, such as charities, are increasingly on the radar of cybercriminals. Similarly, there are also a lot of university phish. This trend began in 2013, but it has become more prevalent this year. Again, these brands provide a gateway for password reuse that allows cybercriminals to gain access to other things.
Targeted attacks against alumni have also become common in the university space. In most cases, the phisher will attempt to gain control of a university email account in order to reach out to trusted parties (such as boards of directors).
#3: Attack frequency has increased, but size has decreased.
The number of attacks has increased, but the average size of a typical attack has dipped. While those “monster” attacks still exist, most phishing emails are now sent to a fewer number of targets than we saw last year.
#4: Phishing Emails are more believable.
Phishing emails are now much more sophisticated. We’re seeing fewer spelling mistakes and more professionalism in email design, which make the email campaigns much more believable and likely to be successful. Commoditization is driving down prices of phish kits, resulting in a much higher quality presentation.
In summary, each of these trends reflect that fact that cybercriminals are very opportunistic. Today’s cybercriminal is more professional and targeted than ever before. Not only does phishing persist as an attack method, it is increasingly more successful.
How does your organization plan to address the rise in phishing activity? Share your comments below.