CHECK POINT SOFTWARE TECHNOLOGIES LTD. For the first time, DHL took the number one spot in Q4, replacing Microsoft as the brand most likely to be targeted by cybercriminals in phishing scams. Twenty-three percent of all brand phishing attempts were related to the global logistics and shipping company, up from just 9% in Q3, as threat actors sought to take advantage of vulnerable online consumers during the busiest retail period of the year. Microsoft, which yet again led the rankings in Q3 by accounting for 29% of all phishing attempts, only accounted for 20% of phishing scams in Q4. FedEx also appeared in the top ten list for the first time in Q4 2021, no doubt the result of threat actors trying to target vulnerable online shoppers in the run-up to the festive season as the pandemic remained a key concern.
The Q4 report also reinforces an emerging trend from Q3, with social media seeming to solidify its position among the top three sectors imitated in phishing attempts. While
'It's important to remember that cybercriminals are opportunists first and foremost. In their attempts to steal peoples' personal data or deploy malware onto a user's machine, criminal groups will often take advantage of consumer trends by imitating popular brands,' said
Omer continued, 'Q4 has also confirmed what many of us were expecting. That social media would continue to be heavily targeted by bad actors looking to take advantage of those leaning more heavily on channels like
In a brand phishing attack, criminals try to imitate the official website of a well-known brand by using a similar domain name or URL and web-page design to the genuine site. The link to the fake website can be sent to targeted individuals by email or text message, a user can be redirected during web browsing, or it may be triggered from a fraudulent mobile application. The fake website often contains a form intended to steal users' credentials, payment details, or other personal information.
Top phishing brands in Q4 2021
Below are the top brands ranked by their overall appearance in brand phishing attempts:
DHL (related to 23% of all phishing attacks globally)
Microsoft (20%)
Google (10%)
LinkedIn (8%)
Amazon (4%)
FedEx (3%)
Paypal (2%)
Apple (2%)
PayPal Phishing Email - Account Theft Example
During November sales days, we noticed a malicious phishing email that was allegedly sent by PayPal and was trying to steal users' credit information. The email (see Figure 1) which was sent from the spoofed address PayPal Service (service@ec2-18-156-114-201[.]eu-central-1[.]compute[.]amazonaws[.]com) was actually sent by admin_emotion_dev@emotionstudios[.]rocks, contained the socially engineered subject '[Alert] Confirm your PayPal account (Case ID #XX XXXXXXXXXX)' which could pressure the victim into clicking on the malicious link (https://serviiceds[.]ritaspizzaportsmouth[.]com/llpy/). The website redirects the user to a fraudulent PayPal login page that looks like the real site (see Figure 2) with a few minor differences in appearance. In the malicious link, the user needed to enter their PayPal account details.
paypal phishing email
Figure 1: The malicious email which was sent with the subject
'[Alert] Confirm your PayPal account (Case ID #XX XXXXXXXXXX)'
paypal realvsfake
Figure 2:
Left side - fraudulent login page
Right side - real login page
Fedex Phishing Email - Malware Attached
During December, we observed a malicious phishing email that used Fedex's branding and was trying to get the user to download SnakeKeylogger malware to their machine. The email (see Figure 1) which was sent from the spoofed address support@fedex[.]com, contained the subject 'Bill of Lading-PL/CI/BL-Documents arrival'. The content is asking to download a RAR archive file 'shipment docu..rar', which contains a malicious executable file that would cause the system to be infected with SnakeKeylogger and could steal the user's credentials information.
fedex phishing email
Figure 1: The malicious email which was sent with the subject
'Bill of Lading-PL/CI/BL-Documents arrival'
DHL Phishing Email - Credentials Theft Example
In this phishing email (see Figure 1), we see an attempt to steal users' email and password. It was sent from the spoofed email address DHL Customer Support (info@emmc[.]ir), contained the subject 'DHL Shipment Notification : xxxxxxxxxx 'Out for delivery' for
dhl phishing email
Figure 1: The malicious email which was sent with the subject
'DHL Shipment Notification : xxxxxxxxxx 'Out for delivery' for
dhl realvsfake
Figure 2:
Left side - fraudulent login page with credentials request
Right side - real login page
As always, we encourage users to be cautious when divulging personal data and credentials to business applications or websites, and to think twice before opening email attachments or links, especially emails that claim to be from companies such as DHL, Microsoft or Whastapp, as they are the most likely to be impersonated.
Blog: https://research.checkpoint.com/
Twitter: https://twitter.com/_cpresearch_
About
About
(C) 2022 Electronic News Publishing, source
