Back in June, we discussed Vade Secure’s “Phisher’s Favorite” report for Q1 2019, which found that Microsoft had been the most impersonated brand used in phishing attacks for four quarters in a row. Vade’s report for Q2 2019, just out, reveals that Microsoft has now held the lead for the fifth quarter straight. PayPal came in second, and Facebook rose to take #3.
Vade says there are two reasons why Microsoft has topped the list for the past five quarters. The first is the popularity of Office 365, particularly among enterprises. The number of phishing attacks targeting a particular brand naturally scales with how widespread that brand’s products are. The second reason is the value of Office 365 credentials. Compromising one of these accounts grants an attacker access to SharePoint, OneDrive, Skype, and other services, as well as the organization’s Global Address List.
PayPal has long been a popular target for phishing attacks due to its status as the most popular online payment service in the world. Hacking someone’s PayPal account gives the attacker an immediate monetary payoff. Attacks impersonating PayPal are up 112% compared to Q2 2018.
The rise of phishbait mimicking Facebook and Amazon is perhaps the most significant finding of the report. Facebook phishing attacks had a year-over-year growth of 176%, overtaking Netflix for the #3 spot. The researchers suspect this is due to the growing adoption of Facebook’s single sign-on, which increases the value of a hacked Facebook account.
Meanwhile, Amazon rose fifteen spots to #8 on the list—a 411% increase year-over-year. The researchers observed a spike in May, probably due to a popular new phishing kit that targeted Amazon users. Vade also noted that Amazon phishing email subjects are more varied than those targeting other brands.
Scammers never stop churning out phishing emails, and they adapt their campaigns to focus on the most lucrative targets. New-school security awareness training can help your employees keep up with these trends so they know what to watch out for.
Vade Secure has the story: https://www.vadesecure.com/en/phishers-favorites-q2-2019/
Here's how it works:
