APWG Phishing Attack Trends for Q3 2020

The Anti-Phishing Work Group (APWG) has published their phishing trend findings for Q3 of 2020. The contents of this report show a continuing increase in phishing attacks and Business Email Compromise attacks across multiple verticals. Phishing is a type of criminal activity employing both social engineering and technical subterfuge to steal consumers’ personal information and financial data. Social engineering schemes prey on unwary victims by fooling them into believing they are dealing with a trusted, legitimate party, such as by using deceptive email addresses and email messages. APWG’s report goes into detail on these subjects as well as providing statistics on trend data observed.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
Always verify the sender of suspicious or unexpected emails and messages
Never download attachments from unknown senders or suspicious emails
Never click on links or enter credentials when prompted unless you have checked the URL and purpose of the request is legitimate
Reach out to your ZeroFOX account manager or [email protected] if you need help setting up monitoring, configuration or want more information about the associated website

Details

APWG’s report reveals a rise in phishing since March of 2020. And in August and September of 2020, more than 200,000 phishing sites were reported per month to APWG, with more that 500 brands being targeted each month in the quarter.

Figure 1: Excerpt showing an upwards trend of reported phishing for Q3

Phishing targeting users of webmail and Software-as-a-Service (SaaS) was found to be the biggest target of phishing, with over 30 percent of all attacks. Financial Services were the target of 19.2 percent of attacks, and payment processing systems such as PayPal were targets of 13.4 percent of attacks. Phishing targeting social media was 12.6 percent of attacks, primarily driven by phishing against brands such as Facebook and WhatsApp.

Figure 2: An example of a typical WhatsApp “fake invite” phishing page

Business Email Compromise (BEC) attacks that focus on key personnel within targeted enterprises, continues to be one of the most popular types of attack, as well as being one of the most damaging. BEC attacks that sought wire transfers from victim companies sought an average of $48,000. Also, scammers requested funds in the form of gift cards in 71 percent of BEC attacks, which are easier to cash out. During the third quarter of 2020, the average amount of gift cards requested by BEC attackers was $1,205. Additionally, around 16.3 percent of BEC attacks involved specially crafted domain names registered by the scammers, that they used to send email to their intended victims.

Figure 3: An example of a typical BEC email asking for gift cards

Phishers are also deploying encryption to fool users into thinking that phishing sites are legitimate and safe. In the third quarter of 2020, 80 percent of phishing sites had SSL encryption enabled. Most SSL certificates used by phishers were Domain-Validated ('DV'), which is the weakest form of certificate validation. Around 91.3 percent were DV, while 8.6 percent were OV (Organization Validation) certs, and just 0.1% were Extended Validation (EV).

The full report from APWG can be found here.