Hiding malicious payloads behind legitimate websites is a practice that rose 121% between the end of 2022 until the end of April of this year. The trend was identified by Egress, a cybersecurity company specialising in intelligent email security, as part of its inaugural Email Threats Pulse Report. 

Hackers will use hyperlinks from reputable brands such as YouTube, Amazon AWS, and Google Docs to deliver attacks. This has allowed them to evade standard link checks when carrying out a cyber attack. 

“Our report reveals that attacks are increasingly leveraging social engineering, advanced technical measures, and compromised email addresses to deliver sophisticated payloads or defraud organisations,” said Jack Chapman, VP of threat intelligence at Egress. “Every attack we analysed had bypassed other forms of anti-phishing detection, including secure email gateways.”

The report also identified the growing threat of phishing emails toward C-suite members. CFOs (31%), CEOs (25%) and CMOs (13%) making up over two thirds of targets of phishing attempts. Functions related to security risk and compliance were the least targeted group, due to their increased security awareness, says the report. 

Cybercriminal gangs have also taken to selling phishing ‘kits’ according to Egress. These kits are designed for less skilled criminal actors with lower motivation than an organised and skilled cybercriminal. The proliferation of the means to conduct phishing attacks among common criminals reinforces the need for companies to stay ahead of the curve of the cybercrime landscape. 

Recommended

• Comment: Is Quiet Hiring the Solution to the Tech Skills Shortage?
• BR-DGE and Volt Partner to Help Merchants Prevent Payment Fraud
• £50M Space Infrastructure Fund Launched by UK Government

Another key trend in this report was the increased usage of compromised legitimate email accounts. The report found that this number rose 51% in the first four months of 2023. This mixed with 71% of attachment-based payloads being HTML attacks, allowed for more attackers to build malware behind an organisations firewall

“The evolution of phishing emails continues to pose a major threat to organisations, emphasising the need to enhance defences to prevent attacks,” said Chapman. 

Enhancements in mind were the prioritisation of what Egress calls behaviour-based email security. Technologies such as integrated cloud email security (ICES) uses natural language-processing and natural language understanding to protect from sophisticated attacks. ICES can analyse emails for signs of email compromise. Solutions like this can be integrated into users’ inboxes, however, it remains important as ever to engage users with awareness and training programs.