Story image

Social media phishing on the rise as attackers experiment with tactics

05 Mar 18

Social media has eclipsed financial institutions for the most popular targets for phishing attacks, suggesting a pivot in tactics away from traditional cloud service providers.

In this context, phishing is characterised as the ways cybercriminals innovate to trick users into handing over personal information, financial information and user account details..

RiskIQ’s Q4 2017 statistics looked at 27.285 blacklisted phishing domains that targeted 259 unique brands.

While the number is lower than in the previous quarter, the firm saw a ‘stark’ increase in phishing campaigns leveraging social media platforms.

Why are attackers going after social media? RiskIQ says there are several reasons why this may be the case.

“For one, the growth in popularity of financial integrations within social media platforms that, for example, give users the ability to send and receive money, can make for an easy payday. There’s also the possibility of using sensitive information from posts, messages, and profiles that can be used as lures in social engineering attacks.”

While social media platforms are becoming a popular target, financial institutions still make up the majority of phished brands. 40% of brands are financial institutions; 20% are social media platforms; 20% are large tech companies; and 20% are digital transaction providers.

In Q3 2017, only 10% of phishing attacks leveraged social media platforms.

RiskIQ will not name the brands used as part of the phishing attacks, but does name some of the registrars and hosting providers that are helping to cause trouble.

“There are two types of phishing sites: those that use compromised websites and those that use malicious registrations,” RiskIQ notes in its Q3 report.

Behind the scenes, data suggests that there are a handful of domain registrars behind the scenes, including the likes of Hostinger, GoDaddy and eNom. These have apparently become ‘tried and true’ tools for phishers.

Meanwhile hosting providers responsible for propagating phishing attacks are a little more difficult to pin down: Hostinger and CyrusOne featured heavily in Q4 data for blacklisted URLs by hosting provider, however only one of the culprits appeared in Q3 data.

The company notes that phishing tends to happen in a cyclical pattern. This contributed to a slight overall drop in detections.

“The number of observed domains and targeted brands remained relatively close each quarter, but the number of unique URLs varied widely,” RiskIQ explains.

“Financial institution targets showed a general decline while social media targets showed a general increase, especially over the last quarter. Q4 was also the first quarter observed where the top targeted brand was a social media platform. While this is not a new phenomenon by any means, our data has never displayed its presence as prominently as Q4 of 2017,” the company concludes.

Disruption in the supply chain: Why IT resilience is a collective responsibility
"A truly resilient organisation will invest in building strong relationships while the sun shines so they can draw on goodwill when it rains."
Businesses too slow on attack detection – CrowdStrike
The 2018 CrowdStrike Services Cyber Intrusion Casebook reveals IR strategies, lessons learned, and trends derived from more than 200 cases.
What disaster recovery will look like in 2019
“With nearly half of all businesses experiencing an unrecoverable data event in the last three years, current backup solutions are no longer fit for purpose."
Proofpoint launches feature to identify most targeted users
“One of the largest security industry misconceptions is that most cyberattacks target top executives and management.”
McAfee named Leader in Magic Quadrant an eighth time
The company has been once again named as a Leader in the Gartner Magic Quadrant for Security Information and Event Management.
Symantec and Fortinet partner for integration
The partnership will deliver essential security controls across endpoint, network, and cloud environments.
Is Supermicro innocent? 3rd party test finds no malicious hardware
One of the larger scandals within IT circles took place this year with Bloomberg firing shots at Supermicro - now Supermicro is firing back.
25% of malicious emails still make it through to recipients
Popular email security programmes may fail to detect as much as 25% of all emails with malicious or dangerous attachments, a study from Mimecast says.