Blog

Blog

Why Social Media is Increasingly Abused for Phishing Attacks

Today, social media is a daily medium for communication for much of the modern world, and adoption only continues to grow. Because of this, much like how threat actors started to target mobile users, they have begun to abuse social media, too. While marketing teams have been known to monitor social media to protect their brand and communicate on their behalf, they are not equipped to handle...
Blog

Phishing Simulations: Should they Reflect Real-World Attacks?

As the manager of a security awareness team, whose primary goal is to educate users on how to spot phishing attacks, I often get asked, “can you make the phishing simulations look like real-world phish?" This is when I show people what real-world phishing attacks look like. Because our SOC analyzes millions of phishing emails each year, we have a great data set to choose from. Outside of...
Blog

BEC Attacks: How CEOs and Executives are Put at Risk

Business Email Compromise (BEC) attacks are the most costly and effective forms of phishing. In most cases, these attacks use highly research social engineering to go after the top brass in a company with a motive of stealing corporate dollars or breaching their network. And, because in most cases these top executives hold the keys to the castle, they make the most suitable target for threat...
Blog

Low Appetite for Long Security Training? Use a Bite Sized Approach

Although computer-based training has been on the scene for over two decades, it is only recently that learning professionals have begun to optimize it. Often these courses present hours of content in a single learning experience. While the flexibility of computer-based training offers convenience, learners are often overloaded and overwhelmed by the amount of information presented to them. ...
Blog

BEC Attacks: A Closer Look at Invoice Scams

Business Email Compromise attacks are some of the most costly and vicious forms of phishing. Unlike the standard pray and spray approaches to phishing, they take a great deal of research and personalization to persuade a victim to hand over their credentials or wire them funds. This week we're taking a closer look at how invoice scams work, just one of the many sub-types of BEC or spearphishing...
Blog

How Spear Phishing Makes BEC Attacks So Effective

Everyone will at some point see a standard phishing email. Be it the 409 Scam (Nigerian Prince) or even a fake password reset, these are pretty easy to spot, and most people delete it without flinching. However, for the select few who have been on the receiving end of a spear phish, it's often a more memorable experience. A spear phish or spearphishing attack is an advanced form of phishing...
Blog

Romanian Cybercriminals Sentenced for Phishing Campaign

This week, the Department of Justice for the U.S. Attorney's Office for the Northern District of Georgia announced the final of three sentences to be carried out by cybercriminals that plead guilty to carrying out phishing campaigns involving vishing and SMiShing. I'm proud to say that the apprehension and conviction of these criminals was supported in part by intelligence PhishLabs provided in...
Blog

How Business Email Compromise (BEC) Attacks Impact Everyone

Business email compromise (BEC) attacks are among the most effective forms of phishing in our modern world. Regardless of the technology in place, the social engineering involved easily will bypass it and can trick even trained users. Most Common Types of Business Email Compromise (BEC) attacks: Invoice Scams Account Compromise/Takeover CEO or Executive Fraud Legal Impersonation Data...
Blog

Threat Actors are Increasing Their Use of Free Hosts

In our continued expansion and exploration of data from this year's annual Phishing Trends and Intelligence report it's time to take a closer look into free hosts. More specifically, the free hosts and domains that threat actors abuse in order to further distribute phishing attacks. While phishing sites that abuse free hosts don't make up the majority, the use of them is increasing dramatically...
Blog

Phishing Number One Cause of Data Breaches: Lessons from Verizon DBIR

In the cyber security world, few research reports are more widely respected than Verizon's annual Data Breach Investigations Report (DBIR). The DBIR—which is based on data from publicly disclosed security incidents, Verizon's Threat Research Advisory Center, and dozens of industry contributors—is one of the most detailed and comprehensive reports available to the security community. So when...
Blog

More Than Half of Phishing Sites Now Use HTTPS

As more of the web further embrace HTTPS and SSL certs, it's becoming a requirement that threat actors use it, too. By the end of Q1 2019, more than half of all phishing sites have employed the use of HTTPS, now up to 58%. This is a major milestone and shows that threat actors actions often mirror that of the majority of users. “In Q1 2019, 58 percent of phishing sites were using SSL...
Blog

The Definition of Phishing

Defining phishing is simple, right? Not exactly. With more than 18,400,000 results appearing on Google when trying to find the definition there is a lot for you to choose from. Even Wikipedia has its own version, which may be more accurate, but still misses a few key elements. As a company, PhishLabs has seen the scope of how phishing is changing since first being named, which is why it's time...
Blog

Should User Passwords Expire? Microsoft Ends its Policy

If you have ever worked for an organization that uses Microsoft-based systems, there is a high likelihood that your IT or security team has implemented a policy that occasionally forces you to create a new password. Years ago it was every three months, then every two, and so on. This policy was heavily encouraged by Microsoft, but as of May of this year, they have reversed course. According to...
Blog

6/13 Webinar: Handling Threats That Land in User Inboxes

The risk of a user receiving a phishing attack is higher than ever, and technological solutions often miss the most devastating of them. Though technology is both an important and required component in protecting the enterprise, security teams need to remain vigilant and educated on quickly identifying threats which make it past technology. This includes the latest social engineering...
Blog

The Rise in Mobile Phishing Attacks

Each year new phishing techniques result in more attacks successfully landing in user inboxes. In most cases, threat actors are no different than anyone else, and follow the hottest trends in an effort to be more relevant. During tax season they may push out tax scams, during elections they may push bogus political-inspired healthcare emails, and there are even Game of Thrones inspired...
Blog

These Are the Top Most Targeted Countries by Phishing Attacks

The United States is once again, and for the foreseeable future, the most targeted country by threat actors' phishing attacks. Making up an astonishing 84% of all phishing volume, the U.S. saw a single percent decline from 85% last year. But... While this sounds like a positive, the number of attacks went up by more than 60,000 in 2018. By comparison, the number of attacks in 2017 only went up...
Blog

Beyond the Top 5 Industries Most Impacted by Social Engineering

In this year's annual Phishing Trends and Intelligence report we identified phishing sites targeting more than 1,200 different brands belonging to 773 parent institutions. Of the top five targeted industries, they accounted for 83.9% of total phishing volume. There are two big takeaways from this finding: financial institutions are back on top, and each industry is still at risk. Through our...
Blog

Phishing Volume Continues to Rise

Back in the olden days of the internet, when AOL's dial-up connection still made horrible sounds prior to getting you access to your inbox, phishing attacks were born. Somewhere in the mid-1990s, internet-based social engineering attacks were born and designed to capture credentials on AOL by way of a program called AOHell, and expanded on to stealing credit card numbers or other private...
Blog

The Most Common Types of Reported Emails

There are all sorts of things that end up in your inbox, but among those that are reported to a SOC or security team, malicious content only makes up a small percent. Among the analysis provided in this year's annual Phishing Trends and Intelligence (PTI) report, we added a new section based on data from our Phishing Incident Response team. The data analysis resulted in a detailed breakdown of...
Blog

2019 Phishing Trends Intelligence Report: The Growing Social Engineering Threat

Phishing has and will continue to be a threat to anyone connected to the web. This is a fact set in stone, and regardless of advancements in technology, social engineering will allow these attacks to continue to be successful. Today, we are releasing our latest version of the annual Phishing Trends and Intelligence report. Using data collected from millions of social engineering attacks...