SlashNext, an AI-driven email, mobile, and web messaging security organisation, has unveiled its 2024 Mid-Year Assessment on The State of Phishing. 

The mid-year assessment indicates a staggering 341% increase in various phishing attacks over the past six months, including malicious phishing links, BEC, QR Code, and attachment-based threats. 

This surge builds on an already significant 856% rise in malicious email and messaging threats over the previous 12 months. Since the launch of ChatGPT in November 2022, there has been an astronomical 4,151% increase in phishing messages.

“Humans have been, and will continue to be, the weakest point in any organisation’s security,,” said Patrick Harr, CEO of SlashNext. 

“There is a reason threat actors continue to iterate on tactics like phishing that have been around for decades – they are highly effective,” he continued. 

“According to Verizon’s 2024 Data Breach Investigations Report, humans are increasingly falling for phishing attacks and it now takes a median time of only 21 seconds for a user to click on a malicious link, and only another 28 seconds to then enter their personal data. 

“We know from our research these attacks are getting a boost from generative AI tools that are readily available. Threat actors are using gen AI to customise messages for their victims, write more convincing messages, and dramatically accelerate the speed and volume of these attacks with little to no added cost.”

Detailed analysis by SlashNext Threat Labs revealed a 217% rise in credential harvesting phishing attacks and a 29% increase in BEC incidents over the past six months.

 According to the FBI IC3 Report, BEC attack losses exceeded $2.9 billion (£2.2bn) in 2023, with each incident costing an average of $137,000 (£107.6K). Additionally, mobile phones have become a primary target, with 45% of mobile threats now attributed to SMS smishing attacks.

Recommended reading

• Is ChatGPT Driving the Rise in Malicious Emails?
• What Were the Most Impersonated Brands For Phishing in Q1?
• SendGrid Phishing Campaign Targeting SMBs

A notable trend is the rise in CAPTCHA-based attacks using CloudFlare, which conceal credential harvesting forms from security systems. Attackers are deploying thousands of domains with CloudFlare’s CAPTCHAs to evade detection.

“Leveraging legitimate services like Microsoft Sharepoint, AWS, and Salesforce to hide phishing and malware is another favourite tactic employed by threat actors because it preys on users’ trust in these tools,” continued Harr. 

“In addition to CAPTCHA-based attacks, QR code-based attacks are growing in popularity and now comprise 11% of all malicious emails – often embedded in legitimate infrastructures. 

“The onus should not be on users to identify and avoid sophisticated attacks, especially when the research proves that relying on training and traditional cybersecurity tools is ineffective against modern attack tactics. It’s time to fight AI with AI and implement AI-powered email and messaging security tools that keep malicious messages out of users’ inboxes altogether.”