[English]Security provider Zscaler has produced a study on phishing attacks. The annual ThreatLabz report sees phishing-as-a-service as the reason for the rise in attacks across industries worldwide. Retail and wholesale was the hardest-hit industry, with phishing attacks up more than 400 percent in the last 12 months.
Advertising
ZScaler Inc. analyzed 12 months (January 2021 to December 2021) of global phishing data from the Zscaler Security Cloud and published it in the ThreatLabz Phishing Reports 2022. The study enables identification of key trends, industries and regions targeted by attackers, as well as emerging tactics. Data from more than 200 billion daily transactions and 150 million daily blocked attacks were analyzed to reveal new threat patterns. This year's report shows a significant 29 percent year-over-year increase in phishing attacks, with retailers and wholesalers bearing the brunt of the increase. Here's an overview of the findings:
- Phishing increased 29 percent globally to a new high of 873.9 million attacks observed in the ZscalerTM Cloud last year
- Retail and wholesale was the most affected industry, with phishing attacks increasing by over 400 percent in the last 12 months
- The U.S., Singapore, Germany, the Netherlands and the U.K. were the most frequent targets of phishing scams
- New phishing vectors, such as SMS phishing, are growing faster than other methods as end users become more suspicious of suspicious emails
- Increased phishing activity is directly related to phishing-as-a-service, as pre-built attack tools lower the technical barriers to entry for criminals
The report highlights an increasing reliance on phishing-as-a-service methods and new attack avenues in the form of SMS phishing, which has become one of the most common methods of penetrating systems.
Phishing most widespread cyber threat
Phishing has always been one of the most widespread cyberthreats, using various methods to steal data. One of the reasons for the increase in this type of attack is the low technical barrier to entry. Criminals use current events, such as the COVID-19 pandemic or cryptocurrencies as a hook to get unsuspecting victims to hand over confidential data in the form of passwords, credit card information and login credentials.
The ThreatLabz Phishing Report 2022 once again highlights the use of well-known brand names or current events as bait. Top phishing targets in 2021 included productivity tools, illegal streaming sites, shopping sites, social media platforms, financial institutions and logistics services.
A global problem
In 2021, the U.S. was the most targeted country globally, accounting for more than 60 percent of all phishing attacks blocked by Zscaler Security Cloud. It was followed by Singapore, Germany, the Netherlands and the UK.
Advertising
Phishing attacks were not observed to the same extent in all countries. In the Netherlands, the number of phishing attacks decreased by 38 percent, possibly due to recently passed legislation increased penalties for online fraud.
Phishing attacks were not evenly distributed across industries. Retail and wholesale businesses saw the most significant increase in phishing attempts, up more than 400 percent. This was followed by the financial and public sectors, where attacks increased by more than 100 percent on average. However, some industries also saw a decrease in phishing attacks last year. Attacks in healthcare decreased by 59 percent and in the service industry by 33 percent.
Phishing-as-a-Service, a growing thread
While phishing has long been one of the most common tactics used by cyber-attackers, employing sophisticated methods, non-technical malware actors are increasingly gaining access to the necessary tools. The underground marketplace for selling attack frameworks and services is growing. By selling or renting pre-packaged phishing tools and services on the dark web, criminals are facilitating the proliferation of phishing scams on a large scale, increasing the likelihood of a further increase in phishing activity.
Defend against phishing attacks
According to the Zscaler ThreatLabz research team, the average company receives dozens of phishing emails every day. Employees at all levels should be trained in recognizing the most common phishing tactics so they can spot these attempts and help prevent financial damage to the company and its reputation.
While it is impossible to completely eliminate the risk of phishing attacks, effective security management can prevent business-critical information from falling into the hands of hackers. The following measures can help mitigate the threat:
- Develop understanding around the risks posed by phishing to make informed decisions about policies and technologies
- Use automated tools and intelligence as a tool to reduce phishing incidents
- Provide training to increase security awareness and employee reporting of suspicious events
- Simulating phishing attacks to identify gaps in security policies and procedures
- Evaluate security infrastructure to deploy the latest research and system capabilities
The full report is available for download (after registration) at ThreatLabz 2022 Phishing Report.
