New data from IBM shows how attackers are leveraging more than just email to elevate their chances of reaching their malicious goals – and their victims are helping them do it.
I’ve covered attacks that leverage voice and email as attack mediums before; they’re not new. But never before have I seen data suggesting just how impactful these attacks really are. According to new data from the IBM Security X-Force Threat Intelligence Index 2022 Full Report, attacks that use voice and email materially increase an attacker’s chances of success.
According to the report, 41% of attacks exploited phishing for initial access – a 24% increase over the previous year. And with a little more than a third of these phishing attacks comes vulnerability exploitation – no doubt taken advantage of by malware.
What’s most interesting in this report is the findings around adding phone calls to email-based phishing attacks. While email-only attacks only netted a 17.8% click rate, those attacks that also used a voice call (so, vishing) resulted in a 53.2% click rate – tripling the engagement of potential victims (and also somewhat indicating a higher likelihood of success, as victims are willing to engage a given scam over two mediums.)
So, it seems that cybercriminals are dialing in on the recipe for success – finding a mix of voice, phishing, and vulnerability exploits that, in sum total, give them the greatest opportunity to achieve their malicious goals.
But because phishing and vishing are material factors in this equation, social engineering is necessary – something that can be easily thwarted by Security Awareness Training that educates users to be vigilant around unsolicited communications, always being on guard when being asked to engage with attachments, links, and queries for information not regularly shared.
Here's how it works:
