Vade has released a report looking at phishing trends in 2022. The researchers say the top three most-impersonated brands last year were Facebook, Microsoft, and Google.
“For the second consecutive year, Facebook was the top impersonated brand, edging out Microsoft,” the researchers write. “With more than 25,000 unique branded phishing websites—Facebook represented nine percent of total phishing from this year’s list. Microsoft finished as runner-up for the second year in row, also representing nine percent of all phishing websites but accounting for nearly 2,000 less than Facebook. Like 2021, Microsoft remains the most impersonated brand in the corporate market. Google jumped into the #3 spot with 1,560 percent YoY growth in phishing pages, the second biggest leap among brands to crack the top 20 in this year’s report.”
The researchers explain that the growing popularity of Google’s productivity suite accounts for the meteoric rise in Google-themed phishing pages.
“Productivity suites are an attractive target for phishers,” Vade says. “With a suite of integrated applications, these digital ecosystems give phishers more opportunities to exploit users before and after an initial compromise. For example, phishers can impersonate integrated applications such as file-sharing solutions in an initial attack, as well as use compromised accounts to distribute malicious links and files through new channels, such as instant messaging tools.”
The report also found that phishing attacks are becoming more targeted and attackers are increasingly abusing legitimate services to evade detection.
“One example surfaced earlier this year when a French career website was targeted by phishers, who applied to job openings with resumes containing phishing links,” the researchers write. “With each application submitted, the career platform auto generated a response email that delivered the malicious resumes to recruiting organizations. Once victims open the PDF resume attachments, they’re prompted to click malicious links that point to a phishing website, where hackers can harvest account credentials. The attack exploits the legitimate servers, IP address, and domain name of the website, making it more difficult for email filters and victims to detect.”
New-school security awareness training can teach your employees to follow security best practices so they can avoid falling for social engineering attacks.
Vade has the story.
Here's how it works:
