Anti-Phishing Working Group (APWG) experts in their new report on this cyber threat analyzed modern phishing techniques. They found out that almost three quarters of modern phishing sites use SSL protection.
From October to December 2019, the number of recorded phishing sites decreased compared to the summer period.
In total, researchers identified 162,155 malicious resources. In general, 2019, according to APWG, has become one of the most dangerous for web users. These findings are also supported by a study by Vade Secure, which found, for example, that number of linked with WhatsApp phishing URLs increased by 13467%.
Significantly increased number of corporate mail hacking (BEC) cases, during which attackers try to obtain data from employees of organizations holding senior positions.
Similarly, an APWG Agari member company has registered criminals who have committed Business Email Compromise (BEC) attacks and used gift cards to withdraw money during the holiday shopping season.
“We saw increases in requests for gift cards for eBay, Target, Best Buy, and Sephora. The increase could be due to the fact that all of these companies sell physical goods, and the attacks took place during the holiday season. It may indicate that scammers are looking to launder money by using the cards to buy physical goods that they can then sell, rather than putting the money into online cryptocurrency exchanges, which is also a popular laundering option”, — write Anti-Phishing Working Group researchers.
In the fourth quarter of last year, phishers used more than 325 recognizable brands per month. In this case, most often the goals were e-mail, payment services and bank sites. What is more, overall phishing in social networks in 2019 doubled.
In addition, one of the key points of the APWG report was the issue of using SSL certificates in phishing attacks. According to experts, the number of malicious sites equipped with such certificates has increased markedly.
As a result, today about three quarters of identified phishing resources use SSL protection. This is the largest figure recorded during the monitoring period.
“Almost three-quarters of all phishing sites now use SSL protection. This was the highest percentage since tracking began in early 2015, and is a clear indicator that users can’t rely on SSL alone to understand whether a site is safe or not”, — told APWG specialists.
Researchers at RiskIQ, a member of APWG, also analyzed 2,149 confirmed phishing URLs reported by APWG in the 4th quarter of 2019 and found that the most popular top-level domains used by phishers are common domains .com, .org, .net and .info.
