ChatGPT and AI tools drive up phishing threats - report

Zscaler has released the findings of its 2023 ThreatLabz Phishing Report. The report views 12 months of global phishing data from the world's largest in-line security cloud to identify the latest trends, emerging tactics, and which industries and regions are most impacted by phishing attacks.

The report found that a majority of modern phishing attacks rely on stolen credentials and outlined the growing threat from Adversary-in-the-Middle (AitM) attacks, increased use of the InterPlanetary File System (IPFS), as well as reliance on phishing kits sourced from black markets and AI tools like ChatGPT. 

Deepen Desai, Global CISO and Head of Security, Zscaler, comments, "Phishing remains one of the most prevalent threat vectors cyber criminals utilise to breach global organisations. Year-over-year, we continue to see an increase in the number of phishing attacks which are becoming more sophisticated in nature. Threat actors are leveraging phishing kits & AI tools to launch highly effective e-mail, SMiShing, and Vishing campaigns at scale.

"AitM attacks supported by growth in Phishing-as-a-Service have allowed attackers to bypass traditional security models, including multi-factor authentication. To protect their environment, organisations should adopt a zero trust architecture to significantly minimise the attack surface, prevent compromise, and reduce the blast radius in case of a successful attack."

The emergence of new AI technology and large language models like ChatGPT have made it easier for cyber criminals to generate malicious code, Business Email Compromise (BEC) attacks, and develop polymorphic malware that makes it harder for victims to identify phishing, the report finds.

Malicious actors are also increasingly hosting their phishing pages on the InterPlanetary File System (IPFS), a distributed peer-to-peer file system that allows users to store and share files on a decentralised network of computers. It is much more difficult to remove a phishing page hosted in IPFS because of its peer-to-peer network aspect.

ThreatLabz recently discovered a large-scale phishing campaign that involves Adversary-in-The-Middle attacks. AiTM attacks use techniques capable of bypassing conventional multi-factor authentication methods. 

Vishing, or voicemail-themed phishing campaigns, have evolved from SMS or SMiShing attacks. Attackers are using real voice snippets of the executive team in these vishing attacks by leaving a voicemail of these pre-recorded messages. Then, recipients are pressured into taking action, like transferring money or providing credentials. Many US-based organisations have been targeted using Vishing attacks. 

Recruitment scams on LinkedIn and other job recruiting sites are also on the rise. Unfortunately, in 2022, many big businesses in Silicon Valley made the tough decision to downsize. As a result, cyber criminals leveraged fake job postings, sites, portals, and forms to attract job seekers. Victims would often undergo an entire interview process, with some even being asked to purchase supplies to be reimbursed later. 

Cyber criminals often find success when impersonating popular consumer and technology brands. Microsoft was once again the most imitated brand of the year, accounting for nearly 31% of attacks as the attackers phished for access to various Microsoft corporate applications of the victim organisations.

Cryptocurrency exchange Binance accounted for 17% of imitated brand attacks, with phishers posing as fake customer representatives from banks or P2P companies. Big brands like Netflix, Facebook, and Adobe rounded out the top 20 most imitated and phished brands. 

The education industry experienced the most significant surge in 2022 phishing attempts, jumping from the eighth spot to number one, with an increase of 576%. ThreatLabz believes the 2022 application process for student loan repayments and debt relief played a role in this surge.

Rounding out the top five industries under attack are finance, insurance, government, and healthcare, which saw just under 31 million attempts in 2021 to over 114 million in 2022, the report states. Retail and wholesale industries, which topped the list as most targeted last year, saw a decrease of 67%. The service industry also saw a decline of 38% from attempts in 2021. 

With the average organisation receiving phishing emails daily, financial losses incurred from malware and ransomware attacks can quickly drive up year-over-year IT costs.

Facing all the threats outlined in this report is a big job, and while the risk of phishing threats can not be eliminated entirely, IT and security teams can learn from observed incidents.

Zscaler recommends the following best practices to manage phishing risk better:

• Understand the risks to better inform policy and strategy
• Leverage automated tools and threat intel to reduce phishing incidents
• Implement zero trust architectures to limit the blast radius of successful attacks
• Deliver timely training to build security awareness and promote user reporting
• Simulate phishing attacks to identify gaps in your program