sb-eu logo
Story image

Thursdays are the most dangerous days for our inboxes, Proofpoint finds

08 Jun 2017

Be especially wary of the dangers lurking in your inbox on Thursdays - because that's when malicious email attachments are likely to spike, according a new report from Proofpoint.

The Human Factor 2017 report says that attackers are going after people more than tech flaws in order to spread malware, steal credentials and money and transfer that money elsewhere.

Business email compromise (BEC) scams may be driving the increases in email attack volumes. The report says that they jumped from 1% of all mail scams in 2015 to 42% housing banking email trojans in 2016.

BEC attacks are the fastest-growing attack types and according to Proofpoint statistics, cost $5 billion worldwide so far.

99% of email-based financial fraud attacks worked through human-based clicks rather than automated malware. Most phishing messages were after Apple IDs, but users most clicked on Google Drive phishing links.

Enterprises don't have full control over all devices uses in their network - the report found that 42% of clicks to malicious links came through mobile devices. 8% occurred through older versions of Windows that are not supported by new patches.

Thursday is also the most popular day for malicious attachment volume - which spikes 38% on that day alone.

Keyloggers and backdoors pop up on Mondays; Ransomware attacks spread more frequently between Tuesday and Thursday. Banking Trojans pop up mostly on Wednesdays. Thursday and Friday are major targets for point-of-sale campaigns.

The report found that 'peak clicking times' - i.e. when users click on suspicious links - coincide with business hours. 95% of those clicks happen in 24 hours, and 50% of clicks happen within the first hour of receiving it.

The median time between emails received and clicked links is just one hour. Most occur within one day after getting the email. More than 90% of those malicious links led to credential phishing pages.

The report also found that social media 'fraudulent support account phishing' jumped 150% last year. Called "angler phishing", attacks targeted bank customers, social media customers and other services that targeted customer posts on companies' social media channels.

Story image
The guide to digital security in unstable times
An increase in vulnerability across different sectors has meant that 2020 has seen more than its fair share of cybersecurity incidents. One of the most effective ways to combat the perils of today’s cyber-threats is to gain a better knowledge of the threat vectors looming over the heads of organisations. More
Story image
Malware and email scams targeting employees spread rapidly in Q2
"Businesses must stay alert and should employ defense-in-depth tactics and equip themselves with multilayered security mechanisms, including high-sensor spam filters and a VPN connection, which would prevent malicious pages from opening."More
Story image
ESET launches the latest version of its Mobile Security solution
“With this latest version of ESET Mobile Security, we want to ensure our users feel completely secure when performing financial transactions on their devices, in addition to being protected from malware and phishing attempts."More
Story image
Proofpoint and CyberArk extend partnership to further safeguard high-risk users
“Our CyberArk partnership extension provides security teams with increased detection and enhanced adaptive controls to help prevent today’s most severe threats."More
Story image
Zero trust is the way to secure the distributed workforce - Empired
Existing security solutions need to evolve to accommodate the new remote workforce.More
Story image
Spending on managed security services in A/NZ to grow despite COVID headwinds
COVID-19 has changed security priorities significantly, and managed security services in A/NZ are set to benefit. More