57% of phishing emails in 2020 were designed for stealing credentials, according to Cofense’s most recent Annual State of Phishing Report. Meanwhile, just 12% of phishing attacks last year were used for delivering malware. Cofense believes this is because credential phishing emails are better at bypassing email security filters than emails with malicious attachments or download links. Likewise, conversational phishing attacks, like business email compromise (BEC), have grown more popular.
“The vast majority of phishing campaigns are credential theft or conversational,” Cofense says. “While malicious attachments still play a role in phishing, the frequency of this has dramatically declined over the years. In fact, most phish attachments these days are not even malware, but instead, conduits to open a browser to further credential theft. While on the decline, we have our finger on the pulse of phishing related malware.”
The researchers add that cyberattacks resulting from credential theft are often harder to detect than those that rely on malware, since the attackers are using legitimate accounts within the organization.
“Remember, credentials are high value,” the report says. “They provide the keys to the castle for adversaries, sometimes allowing for long-term access to sensitive accounts and information. While threat actors constantly develop sophisticated techniques to evade SEGs and steal credentials, many still use tried-and-true methods with significant success. Data breaches and theft originating from stolen credentials are extremely common, giving threat actors access to sensitive data, web servers, end user accounts, and leave the organizational infrastructure vulnerable to other attack types.”
Cofense adds that attackers are also increasingly abusing trusted services from Microsoft, Google, Adobe, DropBox, and others to host their malware or phishing pages, since these services are less likely to be flagged by security measures.
New-school security awareness training can give your organization an essential layer of defense by teaching your employees how to recognize social engineering attacks.
HealthITSecurity has the full story.
