In 2023, a staggering 94 percent of businesses experienced phishing attacks, marking a 40 percent increase from the previous year, as per research from Egress.
The rise in phishing incidents can be attributed to the utilization of AI, especially generative AI, which has simplified the process for threat actors to create malicious content like emails and even deepfake videos. Furthermore, AI aids in developing malware, often planted by threat actors on victims’ devices during phishing attacks, as highlighted here.
Phishing as a Service (PhaaS) is another factor contributing to the surge in phishing attacks. By enabling malicious entities to hire skilled attackers for carrying out phishing campaigns, PhaaS has made it accessible for anyone seeking to launch such attacks, as elaborated here.
Phishing Tactics Evolving
To understand the surge in phishing, it’s crucial to analyze how threat actors leverage AI and PhaaS to adapt to changing circumstances swiftly. They are now able to respond rapidly to dynamic events, which was challenging in the past due to time-consuming manual creation of phishing content.
With advancements in AI and PhaaS, groups can now efficiently initiate targeted phishing attacks, even in response to unforeseen events, a trend that is becoming more prominent.
Discover trending phishing and impersonation techniques in The Phishing & Impersonation Protection Handbook
Phishing Exploiting Current Events
Phishers often exploit ongoing events to trigger responses of excitement or fear among individuals. This is evident in the aftermath of the CrowdStrike “Blue Screen of Death” incident.
Phishing Post CrowdStrike Incident
A flawed update by CrowdStrike on July 19 resulted in Windows systems facing boot issues, leading to phishing campaigns seizing the opportunity to capitalize on the situation. Cyberint identified several typo-squatting domains within the first day, with some attempting to solicit donations through fraudulent means.
Aside from donation scams, there were instances of fraudulent domains offering a fix for a fee, resulting in financial losses for organizations falling victim to these schemes.
Phishing around Planned Events
Phishing attacks are diversified and meticulous when targeting planned events, allowing threat actors sufficient time to orchestrate elaborate scams.
Olympics-related Phishing
The 2024 Paris Olympics served as a backdrop for enticing phishing campaigns which enticed recipients with promises of winning tickets upon a small payment. However, these scams aimed at collecting financial details for malicious ends.
Additionally, scammers setup websites offering fake Olympic tickets, leading to financial losses and reputation damage for unsuspecting victims.
Phishing in Sporting Events
During the UEFA Euro 2024, threat actors launched counterfeit mobile apps impersonating the UEFA, ultimately duping individuals into believing the legitimacy of these apps due to the official branding used.
These malicious apps, not regulated by major app stores, posed a significant threat as users unknowingly downloaded them, potentially compromising security.
Exploiting Seasonal Events
During holiday seasons, phishing attacks targeting gift card scams, non-payment fraud, and fake order receipts peak, exploiting the increased online activity and promotional offers.
Companies and individuals can mitigate phishing risks by understanding the evolving tactics of threat actors and implementing robust security measures, reducing the likelihood of falling victim to such attacks.
Stay Vigilant against Phishing
While AI and PhaaS have streamlined phishing tactics, organizations can proactively anticipate and counter these threats by educating their employees and customers to identify and avoid phishing attempts, safeguarding against potential financial and reputational damage.
Refer to The Phishing & Impersonation Protection Handbook for actionable strategies against phishing attacks.
