Microsoft tops list for most imitated brands for phishing attempts
Microsoft has continued its reign as the most imitated brand for phishing attempts in the second quarter of 2021, according to Check Point Software.
The latest Brand Phishing Report highlighted that technology giant Microsoft was again the brand most frequently targeted by cybercriminals for the third consecutive quarter.
Forty-five percent of all brand phishing attempts were related to Microsoft in Q2 (up six points from Q1). Shipping company, DHL, maintained its position as the second most impersonated brand, with 26% of all phishing attempts related to it, as criminals continue to take advantage of the growing reliance on online shopping.
The latest report further reveals that technology is still the most likely industry to be targeted by brand detail, followed by shipping and retail.
In a brand phishing attack, criminals try to impersonate the official website of a well-known brand by using a similar domain name or URL and web-page design to the genuine site. The link to the fake website can be emailed or texted to targeted, a user can be redirected during web browsing, or it may be triggered from a fraudulent mobile application. The fake website often contains a form intended to steal users' credentials, payment details or other personal information.
Top phishing brands in Q2 2021
Below are the top brands ranked by their overall appearance in brand phishing attempts:
Microsoft (related to 45% of all brand phishing attempts globally)
DHL (26%)
Amazon (11%)
Bestbuy (4%)
Google (3%)
LinkedIn (3%)
Dropbox (1%)
Chase (1%)
Apple (1%)
Paypal (0.5%)
"Cybercriminals are continually increasing their attempts to steal peoples' personal data by impersonating leading brands," says Omer Dembinsky, data research group manager at Check Point Software.
"They're focused heavily on technology, shipping and retail. Microsoft topped the list, in a quarter that saw Microsoft warn of a new Russian Nobelium phishing campaign," he says.
"In Q1 2021, banking was interestingly overtaken on the list by retail, but it has now reclaimed its position in the top three, possibly owing to the likes of the Amazon Prime Day sales.
"In fact, in the run up to Amazon Prime Day in Q2, more than 2,300 new domains were registered about Amazon."
Dembinsky adds, "Unfortunately, it's the human element that often fails to pick up on misspelled domains or suspicious texts and emails, and as such, cybercriminals continue to impersonate trusted brands to dupe people into giving up their personal information.
"In Q2, we also witnessed a global surge in ransomware attacks which are often spread initially through phishing emails containing malicious attachments," he says.
"As always, we encourage users to be cautious when divulging their data, and to think twice before opening email attachments or links, especially emails that claim to be from companies such as Amazon, Microsoft or DHL as they are the most likely to be imitated.
Microsoft Impersonation
During the second quarter of 2021, CPR caught a malicious phishing mail that was trying to steal credentials of a Microsoft account. The email was sent from the spoofed email address Microsoft (no-reply@microsoft[.]com), and contained the subject "Your Subscription Has Been Expired". Here, the attacker was trying to lure victims into clicking a malicious link, which redirects the user to a fraudulent Microsoft login page. In the malicious link, the user needed to key in their Microsoft account details.
Amazon Impersonation
In another phishing email, CPR saw an attempt to steal a user's Amazon account information. The email was sent from the email address Amazon Service (Service@srv[.]androidscrib[.]com), and contained the subject "Your amazon account has been locked". Here, the attacker was trying to lure the victim into clicking on a malicious link, which redirects the user to a fraudulent and malicious page that looks like the real Amazon login website. In the malicious link, the user needed to key in their username and their password.
