Story image

Social media phishing on the rise as attackers experiment with tactics

05 Mar 18

Social media has eclipsed financial institutions for the most popular targets for phishing attacks, suggesting a pivot in tactics away from traditional cloud service providers.

In this context, phishing is characterised as the ways cybercriminals innovate to trick users into handing over personal information, financial information and user account details..

RiskIQ’s Q4 2017 statistics looked at 27.285 blacklisted phishing domains that targeted 259 unique brands.

While the number is lower than in the previous quarter, the firm saw a ‘stark’ increase in phishing campaigns leveraging social media platforms.

Why are attackers going after social media? RiskIQ says there are several reasons why this may be the case.

“For one, the growth in popularity of financial integrations within social media platforms that, for example, give users the ability to send and receive money, can make for an easy payday. There’s also the possibility of using sensitive information from posts, messages, and profiles that can be used as lures in social engineering attacks.”

While social media platforms are becoming a popular target, financial institutions still make up the majority of phished brands. 40% of brands are financial institutions; 20% are social media platforms; 20% are large tech companies; and 20% are digital transaction providers.

In Q3 2017, only 10% of phishing attacks leveraged social media platforms.

RiskIQ will not name the brands used as part of the phishing attacks, but does name some of the registrars and hosting providers that are helping to cause trouble.

“There are two types of phishing sites: those that use compromised websites and those that use malicious registrations,” RiskIQ notes in its Q3 report.

Behind the scenes, data suggests that there are a handful of domain registrars behind the scenes, including the likes of Hostinger, GoDaddy and eNom. These have apparently become ‘tried and true’ tools for phishers.

Meanwhile hosting providers responsible for propagating phishing attacks are a little more difficult to pin down: Hostinger and CyrusOne featured heavily in Q4 data for blacklisted URLs by hosting provider, however only one of the culprits appeared in Q3 data.

The company notes that phishing tends to happen in a cyclical pattern. This contributed to a slight overall drop in detections.

“The number of observed domains and targeted brands remained relatively close each quarter, but the number of unique URLs varied widely,” RiskIQ explains.

“Financial institution targets showed a general decline while social media targets showed a general increase, especially over the last quarter. Q4 was also the first quarter observed where the top targeted brand was a social media platform. While this is not a new phenomenon by any means, our data has never displayed its presence as prominently as Q4 of 2017,” the company concludes.

How to stay safe when shopping online
Online shopping is a great way to avoid the crowds – but there are risks.
Dell EMC embeds security in latest servers
Dell EMC's 14th generation of PowerEdge servers has comprehensive management tools to provide security across hardware and firmware.
Why data backups should be a part of daily operations
"Disaster recovery needs to address complete system failure and provide a set of security policies to govern disaster incidents."
Businesses focusing on threats from within - survey
Over 50% of respondents reported that 100 days of dwell time or more was representative of their organisation.
Corelight and Exabeam partner to improve network monitoring
The combination of lateral movement and siloed usage of point security products leaves many security teams vulnerable to compromise.
SailPoint releases first identity annual report
SailPoint’s research found that many organisations are lacking maturity in their governance processes over identities.
Disruption in the supply chain: Why IT resilience is a collective responsibility
"A truly resilient organisation will invest in building strong relationships while the sun shines so they can draw on goodwill when it rains."
Businesses too slow on attack detection – CrowdStrike
The 2018 CrowdStrike Services Cyber Intrusion Casebook reveals IR strategies, lessons learned, and trends derived from more than 200 cases.