Microsoft Continues to be Most Imitated Brand for Phishing Attempts in Q1 2021

Check Point Research issues Q1 Brand Phishing Report, highlighting the leading brands that hackers imitated in attempts to lure people into giving up personal data

Our latest Brand Phishing Report for Q1 2021 highlights the brands which were most frequently imitated by criminals in their attempts to steal individuals’ personal information or payment credentials during January, February and March.

In Q1, Microsoft was again the brand most frequently targeted by cybercriminals, as it was in Q4 2020. Thirty-nine percent of all brand phishing attempts were related to the technology giant (down slightly from 43% in Q4), as threat actors continued to try to capitalize on people working remotely during the Covid-19 pandemic. DHL maintained its position as the second most impersonated brand, with 18% of all phishing attempts related to it, as criminals persisted in taking advantage of the growing reliance on online shopping.

The report also reveals that technology is still the most likely industry to be targeted by brand phishing, followed by shipping. However, banking has replaced retail in the top three industries this quarter, as two banking brands – Wells Fargo and Chase – are now in the top ten list, showing how threat actors are exploiting the recent surge in digital payments due to the pandemic, and the increased dependency on online banking, shopping and home deliveries, to trick users and commit financial fraud.

In a brand phishing attack, criminals try to imitate the official website of a well-known brand by using a similar domain name or URL and web-page design to the genuine site. The link to the fake website can be sent to targeted individuals by email or text message, a user can be redirected during web browsing, or it may be triggered from a fraudulent mobile application. The fake website often contains a form intended to steal users’ credentials, payment details or other personal information.

Top phishing brands in Q1 2021
Below are the top brands ranked by their overall appearance in brand phishing attempts:

1. Microsoft (related to 39% of all brand phishing attempts globally)
2. DHL (18%)
3. Google (9%)
4. Roblox (6%)
5. Amazon (5%)
6. Wells Fargo (4%)
7. Chase (2%)
8. LinkedIn (2%)
9. Apple (2%)
10. Dropbox (2%)

DHL phishing email – malware example

During the first quarter of 2021, we observed a malicious phishing email that used DHL’s branding and was trying to download the Agent Tesla RAT (Remote Access Trojan) to the user’s machine. The email (see Figure 1) which was sent from a webmail address and spoofed to appear as if it was sent from [email protected], contained the subject, “DHL Import Clearance – Consignment : <number>”. The content asked to download an archive file “DHL-IVN.87463.rar”, which contains a malicious executable file that would cause the system to be infected with Agent Tesla.

Wells Fargo phishing email – account theft example

In this phishing email, we see an attempt to steal a user’s Wells Fargo account information. The email (see Figure 1) which was sent from the spoofed email address [email protected], contained the subject, “Your Online access has been disabled”. The attacker was trying to lure the victim to click on a malicious link, which redirects the user to a fraudulent malicious page that looks like the real Wells Fargo website (see Figure 2). In the malicious link, the user was prompted to key in their username and their password.



As always, we encourage users to be cautious when divulging personal data and credentials to business applications or websites, and to think twice before opening email attachments or links, especially emails that claim to be from companies such as Microsoft or DHL, that are the most likely to be impersonated.