Phishing Attacks Reach an All-Time High, More Than Tripling Attacks in Early 2022

Reaching more than 1 million attacks in a single quarter for the first time, new data on phishing attacks in Q1 of 2022 show an emphasis on impersonation and credential theft.

The Anti-Phishing Working Group (APWG) collects data from a range of security vendors to provide the industry with insight into the current state of phishing attacks. It’s latest quarterly report for Q1 2022 shows some “firsts” we’ve not experienced before in the explosive growth in phishing attacks. According to the report, in Q1 of this year:

• The number of phishing attacks rose by 15% to over 1 million (1,025,968 total phishing attacks) for the first time
• The number of unique phishing email subjects increased 25% to just over 53K, possibly indicating a greater focus on spear phishing attacks, tailoring email subjects to get the attention of their victim recipients
• The number of brands attacked has dipped below the previous record set in September of last year, but has been growing since a massive dip occurred in December, putting brand impersonation on target to surpass last year’s number early
• Impersonation attacks on social media were up 74% from the prior quarter to represent nearly half (47%) of such attacks

The idea of using email as a malicious medium, impersonating people and brands is now a staple in the phishing scammers handbook – so much so that, as the story the data tells, it’s only growing in frequency quarter over quarter.

The only real way to put a stop to such attacks is to make them ineffective. And given that some percentage (albeit a small one) of phishing attacks make it all the way to the Inbox, it’s imperative that users also be a part of managing the ongoing problem of social engineering. By enrolling them in continual Security Awareness Training, users can spot bogus, unusual, and downright malicious-looking emails and see them for the phishing attempt they are.

APWG’s quarterly reports – and the trends they demonstrate – shouldn’t be ignored. Phishing is here to stay. That is, until every organization does something to put it to a stop.