Cybercriminals are constantly looking for the easiest way to make a buck. And, in the case of phishing attacks, it appears that pretending to be Microsoft is the path of least resistance.
Phishing attacks have a higher likelihood of success if they appear to be related to something known to the victim; tracking a package with UPS, a problem with a PayPal transaction, or, according to email defense vendor Vade Secure, various gambits revolving around Office 365 are most popular.
According to their Phishers’ Favorites Report for Q1 2019, Microsoft has remained the #1 impersonated brand in phishing attacks for 4 quarters straight. Using a mix of sophisticated scripting, a copy of the legitimate logon page, and redirection to actual Office 365 pages to avoid suspicion, attackers use Office 365 to harvest credentials.
Image from Vade Secure
These credentials are then either used to continue an attack or sold on the dark web to another would-be cybercriminal.
Also noteworthy is the list of other top impersonated brands (in descending order):
- PayPal
- Netflix
- Bank of America
- Credit Agricole
- DHL
- Dropbox
- Apple
- CIBC
Organizations should take note of the brands being used most often, educating employees via Security Awareness Training to be vigilant when interacting with these brands in email and on the web, taking specific note of URLs, source email addresses, and any requests that appear – even remotely – suspicious.
Free Phishing Security Test
Find out what percentage of your employees are Phish-prone™
Would your users fall for phishing attacks that appear to be from brands they trust? Take the first step now and find out before the bad guys do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here's how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:
