As scammers continue to see massive returns on their phishing attacks, the use of impersonation with well-known brands continues to circle around the dominant players.
If you were going to pretend to be a business in an email that would be sent out to millions, you quickly realize it’s going to need to be a brand that many people know and use. That way, you have a much higher likelihood that recipients of your phishing email will respond.
According to security vendor VadeSecure’s Phishers’ Favorites 2022 Year-in-Review report, this is exactly what we’re continuing to see. The top brands impersonated in phishing attacks are Facebook, Google, Microsoft and PayPal. The use of Facebook as the impersonated brand saw over 25,000 phishing pages pretending to be the social media platform. But in total, the three Meta brands accounted for over 42,000 unique phishing pages collectively.
Despite Facebook dominating the list of impersonated brands, other industries saw dramatic increases in phishing and impersonation. According to the report:
- Financial services (in total) dominated at 34% of all impersonation attacks
- Internet/telco saw a 111% increase in phishing pages
- Cloud saw a 77% increase in phishing pages
The use of impersonation has proven over time to be an effective means of lowering the recipient’s defenses and getting them to engage with malicious content. In the case of all four top impersonated brands, the initial goal is to compromise credentials – something we’ve seen time and time again.
To ensure your organization’s user defenses remain high, it’s necessary to enroll them in Security Awareness Training so they are continually kept vigilant, ready to spot a phishing attack before they fall for it.
