Social media network, LinkedIn, dominated the rankings for the first time ever, accounting for more than half (52%) of all phishing attempts during the quarter. This represents a dramatic 44% uplift from the previous quarter, where the professional networking site was in fifth position accounting for only 8% of phishing attempts. LinkedIn overtook DHL as the most targeted brand, which is now in second position and accounted for 14% of all phishing attempts during the quarter.
The latest report highlights an emerging trend toward threat actors leveraging social networks, now the number one targeted category ahead of shipping companies and technology giants such as Google, Microsoft and Apple. As well as LinkedIn being the most targeted brand by a considerable margin,
Shipping is now the second most targeted category, with threat actors continuing to take advantage of the general rise in e-commerce by targeting consumers and shipping companies directly. DHL is second to LinkedIn, accounting for 14% of phishing attempts; FedEx has moved from seventh position fifth, now accounting for 6% of all phishing attempts; and Maersk and AliExpress have entered the top ten list for the first time. The report highlights one particular phishing strategy that used Maersk-branded emails to encourage the download of spoof transport documents, infecting workstations with malware.
"These phishing attempts are attacks of opportunity, plain and simple. Criminal groups orchestrate these phishing attempts on a grand scale, with a view to getting as many people to part with their personal data as possible," said
He continued: "If there was ever any doubt that social media would become one of the most heavily targeted sectors by criminal groups, Q1 has laid those doubts to rest. While
In a brand phishing attack, criminals try to imitate the official website of a well-known brand by using a similar domain name or URL and web-page design to the genuine site. The link to the fake website can be sent to targeted individuals by email or text message, a user can be redirected during web browsing, or it may be triggered from a fraudulent mobile application. The fake website often contains a form intended to steal users' credentials, payment details or other personal information.
Top phishing brands in Q1 2022
Below are the top brands ranked by their overall appearance in brand phishing attempts:
LinkedIn (relating to 52% of all phishing attacks globally)
DHL (14%)
Microsoft (6%)
FedEx (6%)
Maersk (1%)
AliExpress (0.8%)
Apple (0.8%)
Maersk Phishing Email - Malware Example
During the first quarter of 2022, we observed a malicious phishing email that used Maersk's branding and was trying to download the Agent Tesla RAT (Remote Access Trojan) to the user's machine. The email (see Figure 1) which was sent from a webmail address and spoofed to appear as if it was sent from "Maersk Notification (service@maersk[.]com)", contained the subject, "Maersk : Verify Copy for Bill of Lading XXXXXXXXX ready for verification.". The content asked to download an excel file "Transport-Document", that would cause the system to be infected with Agent Tesla.
LinkedIn Phishing Email - Account Theft Example
In this phishing email, we see an attempt to steal a user's LinkedIn account information. The email (see Figure 1) which was sent from the email address "LinkedIn (smtpfox-6qhrg@tavic[.]com[.]mx)", contained the subject "
As always, we encourage users to be cautious when divulging personal data and credentials to business applications or websites, and to think twice before opening email attachments or links, especially emails that claim to be from companies such as LinkedIn or DHL, as they are currently the most likely to be impersonated.
Blog: https://research.checkpoint.com/
Twitter: https://twitter.com/_cpresearch_
About
.
(C) 2022 M2 COMMUNICATIONS, source