Check Point Research issues Q4 Brand Phishing Report, highlighting the leading brands that hackers imitated in attempts to lure people into giving up personal data

Our latest Brand Phishing Report for Q4 2021 highlights the brands which were most frequently imitated by criminals in their attempts to steal individuals’ personal information or payment credentials during October, November and December 2021.

In Q4, global logistics and distribution company DHL ended Microsoft’s long-standing reign as the brand most frequently imitated by cybercriminals in attempts to steal credentials or deploy malware via sophisticated phishing techniques. Twenty-three percent of all brand phishing attempts were related to DHL, up from just 9% in the previous quarter. The Microsoft brand, meanwhile, only accounted for 20% of all phishing attempts in Q4 versus 29% in Q3. FedEx also appeared in the top ten list for the first time in Q4 2021, no doubt the result of threat actors trying to target vulnerable online shoppers in the run-up to the festive season as the pandemic remained a key concern.

Our latest Q4 report also reinforced the continued imitation of social media brands in phishing scams, with WhatsApp coming third behind DHL and Microsoft in a global list of top targeted brands. The social messaging app, owned by Facebook, moved from 6th position to 3rd, representing 11% of all phishing attempts worldwide.

In a brand phishing attack, criminals try to imitate the official website of a well-known brand by using a similar domain name or URL and web-page design to the genuine site. The link to the fake website can be sent to targeted individuals by email or text message, a user can be redirected during web browsing, or it may be triggered from a fraudulent mobile application. The fake website often contains a form intended to steal users’ credentials, payment details or other personal information.

Top phishing brands in Q4 2021

Below are the top brands ranked by their overall appearance in brand phishing attempts:

 

  1. DHL (related to 23% of all phishing attacks globally)
  2. Microsoft (20%)
  3. WhatsApp (11%)
  4. Google (10%)
  5. LinkedIn (8%)
  6. Amazon (4%)
  7. FedEx (3%)
  8. Roblox (3%)
  9. Paypal (2%)
  10. Apple (2%)

PayPal Phishing Email – Account Theft Example

During November sales days, we noticed a malicious phishing email that was allegedly sent by PayPal and was trying to steal users’ credit information. The email (see Figure 1) which was sent from the spoofed address PayPal Service

(service@ec2-18-156-114-201[.]eu-central-1[.]compute[.]amazonaws[.]com) was actually sent by admin_emotion_dev@emotionstudios[.]rocks, contained the socially engineered subject “[Alert] Confirm your PayPal account (Case ID #XX XXXXXXXXXX)” which could pressure the victim into clicking on the malicious link

(https://serviiceds[.]ritaspizzaportsmouth[.]com/llpy/). The website redirects the user to a fraudulent PayPal login page that looks like the real site (see Figure 2) with a few minor differences in appearance. In the malicious link, the user needed to enter their PayPal account details.

Fedex Phishing Email – Malware Attached

During December, we observed a malicious phishing email that used Fedex’s branding and was trying to get the user to download SnakeKeylogger malware to their machine. The email (see Figure 1) which was sent from the spoofed address support@fedex[.]com, contained the subject “Bill of Lading-PL/CI/BL-Documents arrival”. The content is asking to download a RAR archive file “shipment docu..rar”, which contains a malicious executable file that would cause the system to be infected with SnakeKeylogger and could steal the user’s credentials information.

DHL Phishing Email – Credential Theft Example

In this phishing email (see Figure 1), we see an attempt to steal users’ email and password. It was sent from the spoofed email address DHL Customer Support (info@emmc[.]ir), contained the subject “DHL Shipment Notification : xxxxxxxxxx

“Out for delivery” for 15 Dec 21”. The attacker was trying to lure the victim to click on a malicious link

(http://reg[.]chaindaohang[.]com/wp-content/uploads/2021/07/dhl/index[.]php?i=i&0=vegenat@vegenat[.]es) which redirects the user to a fraudulent DHL home page, that looks like the real website (see Figure 2). In the malicious link, the user was prompted to key-in their email and password.

 

 

As always, we encourage users to be cautious when divulging personal data and credentials to business applications or websites, and to think twice before opening email attachments or links, especially emails that claim to be from companies such as DHL, Microsoft or Whastapp, as they are the most likely to be impersonated.

 

You may also like