Story image

Social media phishing on the rise as attackers experiment with tactics

05 Mar 18

Social media has eclipsed financial institutions for the most popular targets for phishing attacks, suggesting a pivot in tactics away from traditional cloud service providers.

In this context, phishing is characterised as the ways cybercriminals innovate to trick users into handing over personal information, financial information and user account details..

RiskIQ’s Q4 2017 statistics looked at 27.285 blacklisted phishing domains that targeted 259 unique brands.

While the number is lower than in the previous quarter, the firm saw a ‘stark’ increase in phishing campaigns leveraging social media platforms.

Why are attackers going after social media? RiskIQ says there are several reasons why this may be the case.

“For one, the growth in popularity of financial integrations within social media platforms that, for example, give users the ability to send and receive money, can make for an easy payday. There’s also the possibility of using sensitive information from posts, messages, and profiles that can be used as lures in social engineering attacks.”

While social media platforms are becoming a popular target, financial institutions still make up the majority of phished brands. 40% of brands are financial institutions; 20% are social media platforms; 20% are large tech companies; and 20% are digital transaction providers.

In Q3 2017, only 10% of phishing attacks leveraged social media platforms.

RiskIQ will not name the brands used as part of the phishing attacks, but does name some of the registrars and hosting providers that are helping to cause trouble.

“There are two types of phishing sites: those that use compromised websites and those that use malicious registrations,” RiskIQ notes in its Q3 report.

Behind the scenes, data suggests that there are a handful of domain registrars behind the scenes, including the likes of Hostinger, GoDaddy and eNom. These have apparently become ‘tried and true’ tools for phishers.

Meanwhile hosting providers responsible for propagating phishing attacks are a little more difficult to pin down: Hostinger and CyrusOne featured heavily in Q4 data for blacklisted URLs by hosting provider, however only one of the culprits appeared in Q3 data.

The company notes that phishing tends to happen in a cyclical pattern. This contributed to a slight overall drop in detections.

“The number of observed domains and targeted brands remained relatively close each quarter, but the number of unique URLs varied widely,” RiskIQ explains.

“Financial institution targets showed a general decline while social media targets showed a general increase, especially over the last quarter. Q4 was also the first quarter observed where the top targeted brand was a social media platform. While this is not a new phenomenon by any means, our data has never displayed its presence as prominently as Q4 of 2017,” the company concludes.

Comms providers hit by most DDoS attacks in Q3 2018
New data indicates attackers preyed on the large attack surface of ASN-level communications service providers with a ‘bit-and-piece’ approach.
Check Point launches hyperscale network security solution
With Check Point Maestro, organisations can scale up their existing Check Point security gateways on demand.
Should AI technology determine the necessity for cyber attack responses?
Fujitsu has developed an AI that supposedly automatically determines whether action needs to be taken in response to a cyber attack.
Trend Micro’s telecom security solution certified as VMware-ready
Certification by VMware allows communications service providers who prefer or have already adopted VMware vCloud NFV to add network security services from Trend Micro.
Frost & Sullivan honours Honeywell's IIoT value creation
Frost & Sullivan has awarded Honeywell with the 2018 Global Customer Value Leadership Award for its work protecting industrial internet of things (IIoT) customers.
Top cybersecurity threats of 2019 – Carbon Black
Carbon Black chief cybersecurity officer Tom Kellermann combines his thoughts with those of Carbon Black's threat analysts and security strategists.
Google's €50m fine a wake up call for big data analytics
Data analytics are essential to company growth, competitive differentiation, and innovation. But there’s now a huge challenge.
UK security startup Barac sets sights on America
“Malware hidden in encrypted traffic is one of the biggest threats organisations are facing today,” says new EVP global sales.