Annual ThreatLabz Report Reveals Phishing-as-a-Service as the Key Source of
Key Findings
- Phishing attacks rose 29% globally to a new record of 873.9M attacks observed in the
Zscaler TM cloud last year - Retail and wholesale were the most targeted industries, experiencing over a 400% increase in phishing attacks over the last 12 months
The United States ,Singapore ,Germany ,Netherlands , and theUnited Kingdom were the most frequently targeted by phishing scams- Emerging phishing vectors, such as SMS phishing, are increasing faster than other methods as end users become more wary of suspicious emails
- Rising phishing activity is directly linked to “phishing- as-a-service” options, which provide a marketplace of pre-built attack tools that reduce technical barriers to entry for criminals
“Phishing attacks are impacting businesses and consumers with alarming frequency, complexity, and scope - with the rise in phishing-as-a-service making it easier than ever for non-sophisticated actors to launch successful attacks. Our annual report highlights how cybercriminals continue to escalate their usage of phishing as a starting point to breach organizations to deliver ransomware or steal sensitive data,” said Deepen Desai, CISO and VP of
Phishing has always been one of the most pervasive cyberthreats, with various methods used to steal private information. One of the reasons this type of attack grows in prevalence every year is its low barrier to entry. Cybercriminals use current events, such as the COVID-19 pandemic or cryptocurrency, to convince unwitting victims to hand over confidential data, such as passwords, credit card information, and login credentials.
The 2022 ThreatLabz Phishing Report found that phishing attacks lure victims by posing as top brands or promoting topical events. The top phishing themes in 2021 included categories such as productivity tools, illegal streaming sites, shopping sites, social media platforms, financial institutions, and logistical services.
A Global Problem
In 2021, the
Not all countries experienced the same attention from phishing attacks. For example,
Phishing attacks were also not evenly distributed across different industries. Retail and wholesale businesses experienced an increase of over 400% in phishing attempts - the most out of all tracked industries. These businesses were followed by financial and government sectors, with organizations in these industries seeing over 100% increases in attacks on average. However, some industries experienced partial relief from phishing attacks last year. Healthcare saw a notable drop of 59 %, while the services industry saw a decline of 33 %.
Phishing-as-a-Service - The Growing Threat
While phishing has long been one of the most common tactics used in cyberattacks by sophisticated threat actors, it's becoming more accessible to non-technical cybercriminals due to a maturing underground marketplace for attack frameworks and services. By selling their pre-built phishing tools and services on the dark web, cybercriminals are making it easier to deploy phishing scams at scale, creating a greater chance for more phishing activity in 2022.
Countering Phishing Attacks
According to the Zscaler ThreatLabz research team, an average-sized organization receives dozens of phishing emails every day. This means that employees at all levels must be aware of the most common phishing tactics and empowered to spot phishing attempts that can result in financial losses and damage to the business’ brand.
Facing the threats outlined in the 2022 ThreatLabz Phishing Report can be daunting, and while it's impossible to eliminate phishing risk, effective management can prevent business-critical information from falling into the hands of cybercriminals. Among other recommendations,
- Learning and understanding the risks posed by phishing to better inform policy and technology decisions
- Leveraging automated tools and actionable intelligence to empower employees with the tools needed to reduce phishing incidents
- Delivering timely employee training to build security awareness and promote user reporting
- Simulating phishing attacks to identify gaps in security policies and procedures
- Evaluating security infrastructure to ensure access to the latest research and system capabilities
How the Zscaler Zero Trust ExchangeTM Can Mitigate Phishing Attacks
User compromise is one of the most difficult security challenges to defend against. The Zscaler Zero Trust Exchange incorporates phishing prevention controls into a holistic zero trust architecture that disrupts every stage of attacks and minimizes damages. Capabilities include:
- Preventing compromise with full SSL inspection at scale, threat analysis using natively integrated threat intel and IPS signature detection, AI/ML phishing detection, and policy-defined high-risk URL categories commonly used for phishing such as newly observed and newly registered domains.
- Eliminating lateral movement by connecting users directly to apps, not the network, to limit the blast radius of a potential incident.
- Shutting down compromised users and insider threats with in-line application inspection and integrated deception capabilities to trick and detect attackers.
- Stopping data loss by inspecting data both in motion and at rest to prevent theft by an active attacker.
To download the full report, see the ThreatLabz 2022 Phishing Report.
Methodology
The ThreatLabz team evaluated data from the
About
Zscaler™ and the other trademarks listed at https://www.zscaler.com/legal/trademarks are either (i) registered trademarks or service marks or (ii) trademarks or service marks of
Media Contacts
Global PR Director
press@zscaler.com
A photo accompanying this announcement is available at https://www.globenewswire.com/NewsRoom/AttachmentNg/ee00f0a5-1f7f-4e77-8b4f-d178075ec1c7
Zscaler 2022 Phishing Report
2022 Increase in Phishing Attempts
2022 GlobeNewswire, Inc., source