Microsoft is Now Most Imitated Brand by Hackers
By : Krishna Anindyo | Wednesday, October 21 2020 - 15:30 IWST
Ilustration Brand phishing (Photo by Technonlogy For You)
INDUSTRY.co.id - To capitalise on remote workforces created by the coronavirus pandemic, hackers have turned Microsoft into their go-to brand for phishing attacks, making it nearly a fifth of all global phishing attacks in the 3rd quarter of this year.
Microsoft soars from 5th place in Q2 to 1st place in Q3 for brand phishing attacks, making up 19% of all global phishing attacks in July, August and September.
44% of all phishing attacks were delivered by email, followed by web (43%), then mobile (12%).
Researchers provide two screenshots of phishing attacks caught in Q3: Microsoft and Amazon, as well as safety tips for remote workers against brand phishing attacks. Hackers are Leveraging the Microsoft Brand to Trick Remote Workers.
In Q3 2020, Microsoft was the brand most frequently targeted brand by cybercriminals, soaring from fifth place in Q2 to the top of the ranking. 19% of all brand phishing attempts globally traced to the technology giant, as threat actors sought to capitalise on large numbers of employees still working remotely during the COVID-19 pandemic. In Q2, Microsoft made up only 7% of all brand phishing attempts. Below are the top brands ranked by their overall appearance in brand phishing attempts:
Microsoft (related to 19% of all brand phishing attempts globally)
DHL (9%), Google (9%), PayPal (6%), Netflix (6%), Facebook (5%), Apple (5%), Whatsapp (5%), Amazon (4%), Instagram (4%).
For the first time in 2020, DHL entered the top 10 rankings, taking the second spot with 9% of all phishing attempts related to the company.
Email is Top Attack Vector, making up 44% of all Phishing Attacks
During Q3 2020, email phishing was the most prominent type of brand phishing platform, accounting for 44% of attacks, closely followed by web phishing (43%), which was the second most attacked platform compared to Q2, where it ranked first. The top phishing brands exploited by email phishing attacks were Microsoft, DHL and Apple, in that order.
Email (44% of all phishing attacks during Q3)
Microsoft, DHL, Apple, Web (43% of all phishing attacks during Q3), Microsoft, Google, PayPal, Mobile (12% of all phishing attacks during Q3), Whatsapp, PayPal, Facebook.
“Remote workers are a focal point for hackers. Companies globally have their employees working remotely because of the coronavirus pandemic, possibly for the first time ever. There are currently billions of people now working remotely, many of them doing so for the first time in their lives. The sudden change has left many companies and remote workers unprepared to handle the latest cyber attacks. Hackers, sensing big opportunity, are imitating the brand most known for work: Microsoft. I expect Microsoft imitations to continue as we turn the new year. I encourage remote workers to be extra cautious when receiving an email. If you get an email about your ‘Microsoft’ account, I would have my guard up," say Omer Dembinsky, Manager of Data Threat Intelligence, at Check Point Software Technologies shares.
Safety Tips for Remote Workers Against Phishing Attacks
To help remote workers stay safe from phishing attacks, Check Point researchers have issued the following cyber security tips:
Learn the red flags. There are certain characteristics that can giveaway an attack through an email. Some of the red flags are: poor formatting, spelling and grammar mistakes and generic greetings, such as “dear user” or “dear customer”.
Avoid oversharing information. As a general rule of thumb, share the bare minimum, no matter what site you are on. Companies never need your social security number or birthdate to do business with you. Never provide your credentials to third parties.
Delete suspicious emails. If you think something is not right, it probably isn’t. Delete suspicious emails without opening or clicking on any links, or forward them to the IT department for investigation. Go with your gut.
Don’t click on attachments. Do not open attachments in these suspicious or strange emails — especially Word, Excel, PowerPoint or PDF attachments.
Verify the sender. With every email you receive, you must take a good look at who is sending it. Who or what is the source of the email? Are there any misspellings to the email domain? Watch for misspellings or alterations in the email addresses of the email sender. Do not hesitate to block suspicious email senders via your email client.
Keep your technology up-to-date. Make sure all your apps, on your mobile phone and desktop computer, have the latest software versions. These version have the latest vulnerability patches and defenses to keep you safe. Using out-of-date software can leave doorways for hackers to get to your personal information.
Check Point’s Brand Phishing Report is powered by Check Point’s ThreatCloud intelligence, a collaborative network to fight cybercrime which delivers threat data and attack trends from a global network of threat sensors.
The ThreatCloud database holds over 250 million addresses analysed for bot discovery, more than 11 million malware signatures and over 5.5 million infected websites, identifying millions of malware types daily.