KnowBe4's latest reports on top-clicked phishing email subjects have been released for Q1 2023. We analyze 'in the wild' attacks reported via our Phish Alert Button, top subjects globally clicked on in phishing tests, top attack vector types, and holiday email phishing subjects.
IT and Online Services Emails Drive Dangerous Attack Trend
This last quarter's results reflect the shift to IT and online service notifications such as laptop refresh or account suspension notifications that can affect end users’ daily work.
“Cybercriminals are constantly increasing the damage they cause to organizations by luring unsuspecting employees into clicking on malicious links or downloading fake attachments that seem realistic,” said Stu Sjouwerman, CEO, KnowBe4. “Emails that are disguised as coming from an internal source, such as the IT department, are especially dangerous because they appear to come from a trusted place where an employee would not necessarily question it or be as skeptical. Building up an organization’s human firewall by fostering a strong security culture is essential to outsmart bad actors.”
Click here to download the full infographic (PDF). Great to share with your users!
Each quarter, we examine ‘in-the-wild’ email subject lines that show emails that users received and reported to their IT departments as suspicious. In 2023, we've seen mostly IT and online service notifications that could potentially affect users' daily work:
Common ‘In-The-Wild’ Emails for Q1 2023:
- Please review updated financial policies
- Zoom: The meeting has started! Where are you?
- IT: Laptop Refresh
- Meta: Suspicious Activity
- Sharepoint: [[manager_name]] shared "Test_Data" with you
- Microsoft: Microsoft's new password requirements
- HR: Please verify your banking information
- DocuSign: DocuSign Account Suspension Notice
- Webmail: Security alert for [[email]]
- Refund has been processed to your account
We have seen a lot more business related subjects coming from HR/IT/Managers in the past year. Others involve logins on new devices and password resets. Tax-related email subjects became more popular as the U.S. prepared for tax season in Q1. These attacks are effective because they cause a person to react before thinking logically about the legitimacy of the email:
Top Phishing Email Subjects Globally
- HR: Vacation Policy Update
- Password Check Required Immediately
- HR: Important: Dress Code Changes
- Adobe Sign: Your Performance Review
- HR: Please update W4 for file
- IT: Internet Report
- Acknowledge Your Appraisal
- Employee Expense Reimbursement for [[email]]
- Please review the W-9 Agreement Documents
- Recent Activity Report
Unsurprisingly, the #1 attack vector we've seen each quarter was phishing links in the email body. When these links are clicked they often lead to disastrous cyberattacks such as ransomware and business email compromise. Other top attack vectors are as follows:
Top 5 Attack Vector Types
- Link - Phishing Hyperlink in the Email
- Spoofs Domain - Appears to Come From the User's Domain
- PDF Attachment - Email Contains a PDF Attachment
- Branded - Phishing Test Link Has User's Organizational Logo and Name
- HTML Attachment - Email Contains an HTML Attachment
Holiday phishing email subjects for the beginning of the year largely such as a change in schedule, gift card and spa package giveaway are used as bait for unsuspecting users.
Top 10 Holiday Phishing Email Subjects in Q1 2023
- HR: Change in Holiday Schedule
- New Year Gift Card
- Happy St. Patrick's Day
- Happy New Year!
- Massage Green SPA: Win Free Massage for Valentine's Day!
*Capitalization and spelling are as they were in the phishing test subject line.
**Email subject lines are a combination of both simulated phishing templates created by KnowBe4 for clients, and custom tests designed by KnowBe4 customers.
See results from all previous quarters in our Top Clicked Phishing Email Subjects topic.
Here's how it works:
