The past 18 months has seen an increase in the number of phishing attacks. According to APWG (Anti-Phishing Working Group), in the last quarter of 2023 alone, they observed 1,077,501 phishing attacks globally, with 5 million phishing attacks in 2023, the worst year for phishing on record. Cybercriminals are becoming even more sophisticated in how they are able to target victims using the different formats, making use of services on the dark web and using AI.
In this article, we take a look at some of the latest phishing threats, how AI is being used and some of the latest scams to be aware of.
New Types of Phishing Attacks on the Rise
New types of phishing attacks have appeared, including the use of QR codes, “Quishing”, and according to APWG, “vishing”, the use of phone calls for phishing is also increasing every quarter, while phishing attacks on social media platforms exploded in late 2023, constituting 42.8% of all phishing attacks.
QR Codes
With more and more people knowledgeable about the risks of clicking URL links in emails and the rise of QR usage in the last few years following the COVID-19 pandemic, cybercriminals are now using QR codes to redirect recipients to websites. Also known as “quishing”, it is much like a regular phishing email, disguised as an email from a reputable company and cloaked in a sense of urgency, the QR code redirects to a site where victims are asked for login credentials or personal data, or alternatively, opening the link begins an immediate malware download.
Employees should be made aware that when they receive an email with a QR code without warning, or from a sender that is unfamiliar to them, they should not scan the QR code and notify IT of a potential phishing threat. If the email looks legitimate, then it is wise to contact the business to check that the email is genuine. Given that QR codes are read via a smartphone, it is even more important to ensure that mobile device users are using different passwords and passcodes across the applications they use and are using multi-factor authentication.
Vishing and Hybrid Vishing
“Vishing”, or voice phishing, comes in a few different formats. A visher may send a text or email message first to a large number of people asking for the recipient to respond urgently via phone to the cybercriminal’s number at which point personal information is requested. This is also known as “hybrid vishing” using both email or text and phone. Other vishing attempts are made directly via the phone, using automated messages to trick recipients into connecting to either a malicious website or to an agent who continues taking details as part of the scam.
More details about the different types of phishing are available in our glossary >
Online Services making it easy for criminals to more target victims
It is also becoming even easier for criminals to target victims using services on the dark web with access to personal details. As a recent crackdown on cyber fraud demonstrated in April 2024 when arrests were made worldwide to stop industrial-scale fraud, scammers no longer need to have the technical skill to target victims at volume and trick them into making payments online, for example, all they need to do is access a service on the dark web, such as LabHost, which will help them send messages and direct victims to fake websites. This ease of access is leading to phishing attacks on an industrial scale.
AI – generating more convincing phishing campaigns
Cybercriminals are making use of AI to create ever more convincing phishing emails. Using AI enables cybercriminals to mimic legitimate emails, making them much more challenging to identify and bypass security measures.
Misspellings, grammatical errors and awkward wording are one of the red-flags normally associated with phishing emails, but with generative AI, cybercriminals are able to create highly convince text which can also be targeted at specific people and can also be tailored to different channels besides email, such as SMS, phone calls, websites and chatbots.
Add to this the use of machine learning algorithms to analyse large amounts of data on social media and leaked information to create highly tailored phishing emails to specific individuals and organisations, it becomes even more challenging to distinguish authentic communications.
Voice-spoofing and deepfake technology is being used in sophisticated phishing campaigns, where cyber criminals create convincing audio and video impersonations to fool victims.66% of respondents to VMware’s 2022 Global Incidence Threat Report were already reporting encounters with deepfake attacks, which can have significant financial consequences and cause reputational damage.
In January 2024, the UK National Cyber Security Centre also warned that AI will also be leveraged to increase the volume and impact of cyber attacks involving ransomware from now until 2026, as AI is lowering the barrier of entry to attacks for novice cyber criminals with relatively basic skills.
Keeping vigilant
With the continuing evolution of phishing attacks by cyber criminals, the use of AI to create more and more convincing phishing campaigns and easy access by novice cyber criminals to online services in the dark web, the number and types of phishing threats will no doubt continue to increase. It is increasingly important to keep up to date with the latest threats and ensure that employees are kept up-to-date on a regular basis.
In our next article we will take a look at phishing from the employee perspective, explaining how phishing can affect the business, providing a checklist of the different types of phishing, red flags to be aware of and tips for avoiding phishing scams.
