Phishing Attacks Shift to Email Addresses

Phishing Attacks Shift to Email Addresses

Phishing Attacks Shift to Email AddressesPhishing Attacks Shift to Email Addresses

Phishing attacks are exploiting human vulnerabilities and are shifting from user names to email addresses to target organizations’ and individuals’ assets.

Phishers Attack Specific IndustriesPhishers Attack Specific Industries

Phishing volume grew by 33% across the five most-targeted industries: finance (23%), cloud storage (22.6%), webmail and online services (20.6%), payment services (13.9%) and economic (11%).

Top Phishing Target Will ChangeTop Phishing Target Will Change

Cloud storage sites are expected to replace financial institutions as the top target of phishing attacks this year.

Email Addresses Replace User NamesEmail Addresses Replace User Names

Phishers are exploiting email addresses instead of unique user names to mass harvest credentials. This exposes an exponentially greater number of online services to secondary attacks through credential reuse and other methods.

Attacks on Government Tax AuthoritiesAttacks on Government Tax Authorities

Attacks on government tax authorities grew by 300%. More IRS phishing attacks occurred in January 2016 than in all of 2015.

Global Events Affected PhishingGlobal Events Affected Phishing

Phishing volume peaked in mid-2016, and there was a spike in virtual Web server compromises because of major global events, such as Brexit.

U.S. Phishing Attacks Are GrowingU.S. Phishing Attacks Are Growing

The United States’ share of attacks is growing and currently accounts for more than 81% of all phishing attacks.

Phishing Sites Are Hosted In Eastern EuropePhishing Sites Are Hosted In Eastern Europe

59% of phishing sites were hosted in the United States last year, but there also was a very significant increase in the number of phishing sites hosted in Eastern Europe.

Canada Is Hardest HitCanada Is Hardest Hit

Canada suffered more than any other country, as attacks on institutions grew 237% in 2016.

Generic TLDs Gain in PopularityGeneric TLDs Gain in Popularity

.Com Top-Level Domains (TLDs) were associated with more than half of all phishing sites last year, but generic TLDs are becoming more popular because they are low cost and can be used to create convincing phishing domains.

Anti-Detection Techniques Are Used the MostAnti-Detection Techniques Are Used the Most

The researchers collected 29,000 phishing kits targeting more than 300 organizations in 2016. One-third of these kits used anti-detection techniques, 22% used mechanisms to restrict access and 29% used techniques to evade browser-based blocking.

Ransomware Focuses on Likely PayersRansomware Focuses on Likely Payers

Ransomware attacks are now targeting organizations that are most likely to pay, such as those in health care, government, critical infrastructure, education and small businesses.

Karen A. Frenkel
Karen A. Frenkel is a contributor to CIO Insight. She covers cybersecurity topics such as digital transformation, vulnerabilities, phishing, malware, and information governance.

Latest Articles