Most Phishing Emails Are After Credentials

Phishing Emails Are After Credentials57% of phishing emails in 2020 were designed for stealing credentials, according to Cofense’s most recent Annual State of Phishing Report. Meanwhile, just 12% of phishing attacks last year were used for delivering malware. Cofense believes this is because credential phishing emails are better at bypassing email security filters than emails with malicious attachments or download links. Likewise, conversational phishing attacks, like business email compromise (BEC), have grown more popular.

“The vast majority of phishing campaigns are credential theft or conversational,” Cofense says. “While malicious attachments still play a role in phishing, the frequency of this has dramatically declined over the years. In fact, most phish attachments these days are not even malware, but instead, conduits to open a browser to further credential theft. While on the decline, we have our finger on the pulse of phishing related malware.”

The researchers add that cyberattacks resulting from credential theft are often harder to detect than those that rely on malware, since the attackers are using legitimate accounts within the organization.

“Remember, credentials are high value,” the report says. “They provide the keys to the castle for adversaries, sometimes allowing for long-term access to sensitive accounts and information. While threat actors constantly develop sophisticated techniques to evade SEGs and steal credentials, many still use tried-and-true methods with significant success. Data breaches and theft originating from stolen credentials are extremely common, giving threat actors access to sensitive data, web servers, end user accounts, and leave the organizational infrastructure vulnerable to other attack types.”

Cofense adds that attackers are also increasingly abusing trusted services from Microsoft, Google, Adobe, DropBox, and others to host their malware or phishing pages, since these services are less likely to be flagged by security measures.

New-school security awareness training can give your organization an essential layer of defense by teaching your employees how to recognize social engineering attacks.

HealthITSecurity has the full story

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Topics: Phishing

Subscribe to Our Blog

Comprehensive Anti-Phishing Guide

Get the latest about social engineering

Subscribe to CyberheistNews