Nearly Half a Billion Emails in 2024 Were Malicious

A new report from Hornetsecurity has found that 427.8 million emails received by businesses in 2024 contained malicious content.

“Once again, phishing remains the most prevalent form of attack, responsible for a third of all cyber-attacks in 2024,” Hornetsecurity’s researchers write.

“This was confirmed by the analysis of 55.6 billion emails, showing that Phishing remains a top concern consistently year over year. Malicious URLs and advanced fee scams were responsible for 22.7% and 6.4% respectively.”

The researchers observed fewer malicious attachments in 2024, as attackers shifted their focus to stealing credentials via social engineering.

“The data shows a decrease in the use of malicious attachments, this is due to a rise in reverse-proxy credential theft attacks over the past year, which use social engineering and malicious links (not attachments) to trick users,” Hornetsecurity says.

“These attacks redirect users to fake login pages that capture credentials in real-time, even bypassing two-factor authentication. Malicious URLs are the second most common type of attack, making up 22.7% of all attacks. Their use surged in 2023 and continues to grow as attackers use them in credential-stealing attempts. Tools such as Evilginx allow attackers to set up fake login pages to trick users into entering their credentials, which are then captured.”

The researchers also found that shipping companies were the most commonly impersonated brands throughout 2024, with DHL and FedEx topping the list.

“Shipping brands continue to be popular due to the fact that they can be easily incorporated in social engineering style attacks via phishing and smishing,” the report says. “Both attack styles boast a high degree of similarity to real communications from these organizations and easily trick less trained users into giving away personal details and/or payment information.”

New-school security awareness training can give your organization an essential layer of defense by teaching your employees to recognize social engineering attacks. KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.

Hornetsecurity has the story.