Phishing — the act of carrying out hacking and other scams by sending out fake-looking emails that resemble the style of communications from banks and other trusted institutions — has been around for quite some time. But it hit a new level in 2020, according to a report by the Anti-Phishing Working Group.
According to the APWG’s Phishing Activity Trends Report for the fourth quarter, members of the group saw phishing attacks double over the course of 2020, with the categories of financial institution, webmail, and software-as-a-service becoming the most victimized ones during the last quarter of 2020.
Also, per the report, “phishers are using an array of deception techniques to fool users. These include domain names chosen to avoid detection… encryption designed to lull victims into a false sense of security…, and deceptive email addresses used to spoof trusted companies and business contacts.”
The report found that the number of unique phishing Web sites detected in October was 225,304, with 143,950 unique phishing email subjects, from 532 brands targeted by phishing campaigns. The numbers remained high in November and December, but not quite at the level of October.
“Looking back at the entirety of 2020, the ten most-targeted organizations accounted for about 60 percent of the total phishing attacks detected throughout the year,” Stefanie Wood Ellis, Anti-Fraud Product & Marketing Manager at founding APWG member OpSec Online, said in the release. “They were primarily financial institutions, SAAS or webmail-based organizations, and payment providers. Social media services were targeted more frequently, with emphasis on messaging applications. Though the volume is still relatively low, we see cryptocurrency exchanges and related sites being targeted more frequently as well.”
“Working with our customers over the course of 2020 and the COVID-19 pandemic, we’ve seen some shifts from traditional phishing to more elaborate trademark or copyright misuse scams. These include fake marketplaces where the victim loses the money they paid for goods, and their credentials are potentially compromised as well. Leading to further losses,” she added.
As for domain registrars most often used by phishing criminals, 32 percent used Namecheap, while 23 percent used the public domain registry.
APWG, which was founded in 2003, provides an official definition of phishing.
“Phishing is a crime employing both social engineering and technical subterfuge to steal consumers’ personal identity data and financial account credentials. Social engineering schemes prey on unwary victims by fooling them into believing they are dealing with a trusted, legitimate party, such as by using deceptive email addresses and email messages. These are designed to lead consumers to counterfeit Web sites that trick recipients into divulging financial data such as usernames and passwords. Technical subterfuge schemes plant malware onto computers to steal credentials directly, often using systems that intercept consumers’ account usernames and passwords or misdirect consumers to counterfeit Web sites.”
Stephen Silver, a technology writer for The National Interest, is a journalist, essayist and film critic, who is also a contributor to Philly Voice, Philadelphia Weekly, the Jewish Telegraphic Agency, Living Life Fearless, Backstage magazine, Broad Street Review and Splice Today. The co-founder of the Philadelphia Film Critics Circle, Stephen lives in suburban Philadelphia with his wife and two sons. Follow him on Twitter at @StephenSilver.