Cybercriminals are increasingly using phishing attempts to target high-value identity data that can be used for follow-on attacks like ransomware, account takeover, and fraud, according to new research from SpyCloud.

After analysis of more than five million phished data records recaptured from the dark web, the identity threat protection firm has provided a snapshot of the evolving phishing threat landscape, with valuable insights for organisations looking to bolster defences and prevent identity-based attacks.

SpyCloud’s study found that phishing is reaching an industrial scale, with a staggering 94% of Fortune 50 companies having employee identity data exposed due to phishing attacks, highlighting the vulnerability of even the biggest organisations to sophisticated cyber threats.

Of the exposed records, the study found that 81% contained employee email addresses, while 42% included IP addresses and 31% revealed user-agent data, which can identify the specific device and browser used, information that could be exploited for further attacks or identity fraud.

Analysis of the 5.5 million compromised records found that two-thirds contained sensitive data such as login credentials, financial details, or metadata from website visitors, while 37% of the records originated from email targeting lists – a collection of addresses used for phishing campaigns.

Among the most commonly impersonated sectors to see attempted phishing campaigns are telecommunications, IT, and financial services, showing that criminals are looking for vulnerabilities in critical infrastructure and high-value industries.

Phishing-as-a-service platforms, where cybercriminals can access off-the-shelf phishing and spoofing toolkits, along with an increasing use of AI to personalise and tailor phishing campaigns are fuelling attacks, with SpyCloud seeing a 17% increase in phishing attempts over the past six months.

With the ability to automate the creation of sophisticated phishing kits, threat actors can more easily harvest credentials and 2FA codes, distribute phishing links via QR codes, and bypass CAPTCHAs to avoid detection.

Especially concerning is that 82% of the victims SpyCloud identified had already had their email credentials compromised in prior data breaches, giving their attackers a head start in crafting their assaults.

SpyCloud argued that this is evidence of an urgent need for security teams to have more visibility into specific exposures so they can take swift, targeted action, including remediating phished credentials, terminating compromised web sessions, and acting on stolen identity artifacts.

Recommended reading

• Arctic Wolf Threat Report: Ransomware As A Service On the Rise
• Deepfake Fraud Explodes 2,000% In Three Years
• NHS Staff Don’t Think They’re Cyber Ready, BT Finds

“To combat the growing scale and sophistication of phishing attacks, security teams need access to real-time exposed identity data before it leads to broader compromise,” said Trevor Hilligoss, senior VP at SpyCloud Labs.

“One area we find organisations lacking insight is when it comes to phishing target lists, ripe with potential victims of phishing campaigns. 

“Armed with this knowledge, organisations can proactively flag vulnerable accounts, alert these users, and stay even more vigilant to avoid falling prey. This action, further up the attack chain, takes a proactive approach to combating phishing threats before they happen.”