A study conducted by Agari and PhishLabs showed a 5-fold increase in vision attacks from early 2021 to Q1 2022.
The reported cases of voice scams or visual scams have increased by a whopping 550% in the past 12 months alone, according to the report. Quarterly Threat Trends & Intelligence Report co-authored by Agari and PhishLabs. In March 2022, the number of visual attacks experienced by organizations reached the highest level ever reported, surpassing the previous record set in September 2021.
As part of the research, it was found that the two companies “detected and mitigated hundreds of thousands of phishing, social media, email and dark web threats targeting a wide range of businesses and brands”.
“Combined vision campaigns continue to generate staggering numbers, capturing 26.1% of the total market share by volume so far in 2022,” said John LaCour, lead strategist at HelpSystems. We’ve seen an increase in threat actors moving from standard voice phishing campaigns to initiating multi-stage malicious email attacks. In these campaigns, actors use callback numbers in email content to attract, then rely on social engineering and impersonation to trick victims into calling and interacting with a fake representative. “
Why visibility is increasing
According to the report, the explosion in the percentage of vision attacks has surpassed business email compromise (BEC) as the second most reported response-based email threat since Q3 2021. The increasing number of bidirectional sightings reported in research shows that cybercriminals are increasingly relying on different means of attack when it comes to their campaigns.
The number of malicious emails targeting individuals’ inboxes also continued to grow quarterly, following a brief retracement in the final quarter of 2021. This escalation in how quickly employees receive emails. harmful by attempting a cyber attack shows a growing demand. train employees, as email can still find its way through spam folders and into users’ inboxes.
SEE: Mobile device privacy policy (TechRepublic Premium)
Types of harmful emails received
According to the study, emails perceived as potentially harmful by employees increased by 18.3% between 2021 and 2022.
These harmful emails are broken down into the following threat vectors by percentage:
- Attempts to steal credentials (58.7%)
- Feedback-based attacks (37.5%)
- Attempts to distribute malware (3.7%)
80% of credential theft attempts are sent through a phishing link, while 20% arrive in the inbox through an email attachment. Credential theft is consistently the top threat to employees quarterly, according to research, and should be a priority for the workforce to identify, avoid, and report to security teams. security.
Vishing falls under the umbrella of reaction-based attacks, second only to the 419 attack patterns of the Prince of Nigeria. These 419 attacks accounted for the majority of which were logged as a response-based scheme with 54.1% of malicious emails received and BEC was third behind efforts seeing 12.8% of emails. receive.
In the field of malware distribution, Qbot malware dominated the category, accounting for 75% of all activity in this sector in Q1 2022. This represents a 15.1% increase in these attack types.
“As organizations use an ever-expanding variety of digital channels to conduct operations and communicate with consumers, bad actors are given multiple means to exploit their victims,” LaCour said. “Most offensive campaigns are not built from the ground up; they are based on reshaping traditional tactics and incorporating multiple platforms. Therefore, to maintain security, organizations that only consider within the network will no longer be effective. They must also have visibility into multiple external channels to proactively gather intelligence and monitor threats.”
