Most popular phishing topics of 2021: report
With phishing trending across the cybercrime world as a favorite method for obtaining sensitive data, credentials, and banking information, it is no surprise that threat actors diversify their campaigns.
The main phishing topic of 2021 was vaccinations, following treatments for COVID-19 featured in 2020, according to the report by Positive Technologies, with a variety of fake QR codes and vaccination certificates floating around inboxes.
As such, emails featuring fake vaccination polls had the most devastating impact, with 65% of employees using the link to unknowingly go to a malicious website, and 48% entering their corporate credentials into a fake authentication form. Similarly, fraudulent state websites offering users QR codes sprang up - victims were required to provide personal data but would not receive any documentation.
The next popular attack vector was mimicking corporate emails, including HR messages and social-engineered emails from colleagues. 28% of workers clicked on emails about salaries and bonuses, 54% - about social benefits, and 59% - about updated bank charges.
Threat actors also made use of the new TV releases, setting up fake merchandise websites (as in the case with Squid Game,) spreading malware through smartphone games, and inviting users to supply their credentials on fake streaming websites. Similarly, emails inviting to renew subscriptions to music, streaming, and cloud services were popular.
Major sports events also made it high up in the preferred phishing topics. As such, the report highlights the 2022’s FIFA World Cup, which attackers started to exploit already a year ago, sending out invitations “to bid for contracts to supply goods or services for the tournament.” Fake ticket sites were popular with the Tokyo Olympic Games and the UEFA European Championship.
In 2021, malicious hackers also impersonated famous brands, setting up fraudulent bank pages to offer various rewards and payouts for filling out surveys or taking part in loans by providing sensitive information. It was also common to distribute emails detailing problems with mobile banking, encouraging the victim to act as quickly as possible, with hopes of leaving them no time to fact-check the information in the email.
As more people started ordering online, it is no wonder that delivery services were also largely impersonated by threat actors. Generally, fraudulent emails included requests for covering shipping or customs fees or checking the delivery status by clicking on a malicious link.
Interestingly, phishing campaigns related to travel remained prevalent. Cybercriminals would send out links to malicious websites, luring victims in with lucrative deals or massive discounts for hotels, rooms, as well as rail and air tickets.
Threat actors also utilized dating apps by creating fake accounts to convince victims to send them money or share personal information about themselves.
Finally, cybercriminals impersonated well-known companies to pose as fake investment websites. They set up investment platforms to invite users to put their money into cryptocurrency, oil, and gas. Alternatively, they distributed emails (seemingly from banks,) offering victims financial rewards from investors in return for filling out an online form with credit card details.
More from CyberNews:
Subscribe to our newsletter