The prevalence of Office 365 and the Windows OS has caused cybercriminals to choose the software titan as their primary brand used in identity deception phishing scams.
If you were a cybercriminal and wanted to get the attention of the most potential victims possible, you’d obviously use a household name that nearly everyone either uses or is familiar with. According to security firm Agari’s Q1 2019 Email Fraud & Identity Deception Trends report, Microsoft is represented in 8 out of 10 email scams targeting high-value executives. Overall, Microsoft’s brand leads the pack, taking up 44% of all identity deception phishing scams.
Phishing scams that leverage brand deception utilize several tactics. According to the report:
- 50% portray a brand using email display names
- 13% portray an individual using email display names
- 17% use lookalike domains
- 20% leverage compromised accounts
Given that nearly half of all organizations in the world use Office 365, it’s highly likely that your users may be presented, or worse, fall victim to some very convincing scams. Putting users continually through Security Awareness Training to help keep their defenses up when interacting with email and the web.
According to Agari, other well-known domains are used: the IRS, Amazon, AT&T, and more. So, it’s not just a Microsoft thing; you need to train your users to be vigilant, as any familiar brand can be used as part of the next phishing attack.
Free Phishing Security Test
Find out what percentage of your employees are Phish-prone™
Would your users fall for convincing phishing attacks? Take the first step now and find out before the bad guys do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here's how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:
