Check Point Research issues Q2 Brand Phishing Report, highlighting the leading brands that hackers imitated in attempts to lure people into giving up personal data
Our latest Brand Phishing Report for Q2 2021 highlights the brands which were most frequently imitated by criminals in their attempts to steal individuals’ personal information or payment credentials during April, May and June 2021.
In a quarter that saw Microsoft warn of a new Russian Nobelium phishing campaign, the technology giant was again the brand most frequently targeted by cybercriminals, as it was in both Q1 2021 and Q4 2020. Forty-five percent of all brand phishing attempts were related to Microsoft in Q2 (up six points from Q1). Shipping company, DHL, maintained its position as the second most impersonated brand, with 26% of all phishing attempts related to it, as criminals continue to take advantage of the growing reliance on online shopping.
Our latest report also reveals that technology is still the most likely industry to be targeted by brand phishing, followed by shipping and retail. In Q1 2021, retail was interestingly overtaken in the list by banking, but it has now reclaimed its position in the top three possibly owing to the likes of the Amazon Prime Day sales.
In a brand phishing attack, criminals try to imitate the official website of a well-known brand by using a similar domain name or URL and web-page design to the genuine site. The link to the fake website can be sent to targeted individuals by email or text message, a user can be redirected during web browsing, or it may be triggered from a fraudulent mobile application. The fake website often contains a form intended to steal users’ credentials, payment details or other personal information.
Top phishing brands in Q2 2021
Below are the top brands ranked by their overall appearance in brand phishing attempts:
- Microsoft(related to 45% of all brand phishing attempts globally)
- DHL (26%)
- Amazon (11%)
- Bestbuy (4%)
- Google (3%)
- LinkedIn (3%)
- Dropbox (1%)
- Chase (1%)
- Apple (1%)
- Paypal (0.5%)
Microsoft Phishing Email – Credentials Theft Example
During the second quarter of 2021, we have witnessed a malicious phishing mail which was trying to steal credentials of a Microsoft account. The email (see Figure 1) which was sent from the spoofed email address Microsoft (no-reply@microsoft[.]com), contained the subject “Your Subscription Has Been Expired”. The attacker was trying to lure the victim to click on a malicious link (http://adminsys[.]serveftp[.]com/nensa/fabio/ex/478632215/zer7855/nuns566623) which redirects the user to a fraudulent Microsoft login page (see Figure 2). In the malicious link, the user needed to key in their Microsoft account details.
Figure 1: The malicious email which was sent with the subject “Your Subscription Has Been Expired”
Figure 2: fraudulent login page
Amazon Phishing Email – Account Theft Example
In this phishing email, we see an attempt to steal a user’s Amazon account information. The email (see Figure 1) which was sent from the email address Amazon Service (Service@srv[.]androidscrib[.]com), contained the subject “Your amazon account has been locked”. The attacker was trying to lure the victim to click on a malicious link, which redirects the user to a fraudulent malicious page that looks like the real Amazon login website (see Figure 2). In the malicious link (https://habitosdamente[.]com[.]br/wp-admin/includes/logs/update-your-account-information/security-measure/?iyh_re), the user needed to key in their username and their password.
Figure 1: The malicious email which was sent with the subject “Your amazon account has been locked”
Figure 2: fraudulent login page
As always, we encourage users to be cautious when divulging personal data and credentials to business applications or websites, and to think twice before opening email attachments or links, especially emails that claim to be from companies such as Amazon, Microsoft or DHL, as they are the most likely to be impersonated.