The prevalence of cloud applications is changing the way threat actors are using phishing attack delivery methods to steal data, according to new research from Netskope.
The report details trends in phishing delivery methods such as fake login pages and fake third-party cloud applications designed to mimic legitimate apps, the targets of phishing attacks, where the fraudulent content is hosted, and more.
Although email is still a primary mechanism for delivering phishing links to fake login pages to capture usernames, passwords, MFA codes and more, the report reveals that users are more frequently clicking phishing links arriving through other channels, including personal websites and blogs, social media, and search engine results. The report also details the rise in fake third-party cloud apps designed to trick users into authorising access to their cloud data and resources.
Traditionally considered the top phishing threat, 11% of the phishing alerts were referred from webmail services, such as Gmail, Microsoft Live, and Yahoo. Personal websites and blogs, particularly those hosted on free hosting services, were the most common referrers to phishing content, claiming the top spot at 26%. The report identified two primary phishing referral methods: the use of malicious links through spam on legitimate websites and blogs, and the use of websites and blogs created specifically to promote phishing content.
Search engine referrals to phishing pages have also become common, as attackers are weaponising data voids by creating pages centred around uncommon search terms where they can readily establish themselves as one of the top results for those terms. Examples identified by Netskope Threat Labs include content on how to use specific features in popular software, quiz answers for online courses, user manuals for a variety of business and personal products, and more.
"Business employees have been trained to spot phishing messages in email and text messages, so threat actors have adjusted their methods and are luring users into clicking on phishing links in other, less expected places," says Ray Canzanese, Threat Research Director, Netskope Threat Labs.
"While we might not be thinking about the possibility of a phishing attack while surfing the internet or favourite search engine, we all must use the same level of vigilance and scepticism as we do with inbound email, and never enter credentials or sensitive information into any page after clicking a link. Always browse directly to login pages," he says.
Netskope's report discloses another key phishing method: tricking users into granting access to their cloud data and resources through fake third-party cloud applications. This early trend is particularly concerning because access to third-party applications is ubiquitous and poses a large attack surface. On average, end-users in organisations granted more than 440 third-party applications access to their Google data and applications, with one organisation having as many as 12,300 different plugins accessing data an average of 16 plugins per user. Equally as alarming, over 44% of all third-party applications accessing Google Drive have access to either sensitive data or all data on a user's Google Drive – further incentivising criminals to create fake third-party cloud apps.
"The next generation of phishing attacks is upon us. With the prevalence of cloud applications and the changing nature of how they are used, from Chrome extensions or app add-ons, users are being asked to authorise access in what has become an overlooked attack vector," says Canzanese.
"This new trend of fake third-party apps is something were closely monitoring and tracking for our customers. We expect these types of attacks to increase over time, so organisations need to ensure that new attack paths such as OAuth authorisations are restricted or locked down," he says.
"Employees should also be aware of these attacks and scrutinise authorisation requests the same way they scrutinise emails and text messages. "
Within the report, Netskope Threat Labs includes actionable steps organisations can take to identify and control access to phishing sites or applications, such as deploying a security service edge (SSE) cloud platform with a secure web gateway (SWG), enabling zero trust principles for least privilege access to data and continuous monitoring, and using Remote Browser Isolation (RBI) to reduce browsing risk for newly-registered domains.
Additional key findings from the report include:
Employees continue to click, fall victim to malicious links. It is widely understood that it takes just one click to severely compromise an organisation. While enterprise phishing awareness and training continues to be more prevalent, the report reveals that an average of eight out of every 1,000 end-users in the enterprise clicked on a phishing link or otherwise attempted to access phishing content.
Users are being lured by fake websites designed to mimic legitimate login pages. Attackers primarily host these websites on content servers (22%) followed by newly registered domains (17%). Once users put personal information into a fake site, or grant it access to their data, attackers are able to capture usernames, passwords, and multi-factor authentication (MFA) codes.
Geographic location plays a role in the access rate of phishing. Africa and the Middle East were the two regions with the highest percentages of users accessing phishing content. In Africa, the percentage of users accessing phishing content is more than 33% above average, and in the Middle East, it is more than twice the average. Attackers frequently use fear, uncertainty, and doubt (FUD) to design phishing lures and also try to capitalise on major news items. Especially in the Middle East, attackers appear to be having success designing lures that capitalise on political, social, and economic issues affecting the region.