Phishing attacks are one of the most favoured attacks among cybercriminals, with 84% of organisations across 15 countries in Europe and the Middle East falling victim to at least one successful attack last year, according to Proofpoint’s State of the Phish report. Of the organisations targeted, 54% of them experienced three or more successful phishing attacks. 

The UK is unique in that it is the largest target for phishing attacks in Europe, according to Proofpoint. They state that 96% of organisations in the UK were targeted by phishing last year. 

A phishing attack, in essence, is where a malicious actor targets an individual through email, text, or phone call to dupe them into sharing personal information. Phishing attacks remain an enduring problem due to their cost effectiveness and ability to yield consistent results for threat actors.  

To help organisations navigate the dangers of phishing schemes, Proofpoint compiled some of the emerging and popular tactics to be vigilant against. 

Popular techniques 

The first popular technique among malicious actors is multi-factor authentication (MFA) phishing. MFA is a popular security measure which prompts users to verify their identity by approving the login through their email or phone. 

Malicious actors are targeting credentials that approve the authentication in order to get into the user’s accounts. For example, access to the user’s Gmail account could approve entry into many accounts linked to that email. Other threat actors might also trick victims into approving a fraudulent login request. 

Another, more sophisticated MFA attack is a tool called EvilProxy which offers victims a URL to click on that leads them to a seemingly legitimate login page. The proxy then communicates with the legitimate site to authenticate the user’s login. The user therefore thinks they are interacting with the real website while the threat actor has the authentication cookie. 

Another growing vector of phishing attacks are telephone-oriented attack deliveries (TOAD). This attack is quite simple: a threat actor sends an email pretending to be a customer service representative and persuades the victim to call the number included in the email to address the fictional issue. 

From there, the threat actor will persuade the caller to disclose sensitive information such as credit card numbers, login credentials, and other personal data. Proofpoint has noticed a peak of 600,000 TOAD messages sent per day, and this number has been rising steadily since 2021. 

Chatbot phishing is the last significant attack method proofpoint is warning organisations to look out for. Chatbot phishing describes a malicious actor’s ability to leverage artificial intelligence tools like ChatGPT to carry out phishing attacks.

Large language models are already being used to make phishing emails sound more professional and authentic, as well as proliferating the method to malicious actors with poor language skills. Proofpoint also suggests chatbots may soon be able to produce prose in the style of real people to further strengthen credibility of the communication sent to a victim.

Common characteristics of phishing

While the method of phishing may vary depending on the end goal or victim, there are certain commonalities to look out for throughout them all. 

Many attackers will create a sense of fear to lure their victims into making irrational decisions. According to Proofpoint, attackers use this method nine in ten times, making the victim afraid of losing money, being locked out of an account, offending someone, or even fear of missing out on an opportunity. 

Similar to stimulating fear in victims, attackers will often create a sense of urgency to make a decision. The attacker will implore the victim to make a decision right away, not giving them time to think critically about the situation. 

Many victims will also impersonate someone the victim trusts to carry out the attack. In many business-related attacks, the threat actor will impersonate a colleague. This goes hand in hand with the last common characteristic which is name spoofing, where the attacker will spoof their display name to appear legitimate. 

Recommended

• Proofpoint Report Highlights Concerning Impact of Phishing Attacks
• Top UK Universities Failing to Implement Strong Email Security
• UK Construction Firms Face Cyberattack Following Dark Web Data Leak

How to protect yourself

In order to keep yourself safe, Proofpoint offers some methods to avoid phishing attacks.

When you receive something that may be suspicious, such as an email with urgent language, report it right away. You must also validate the email address of the sender, and if possible confirm the request through another communication channel. Further, if an email or text message provides you with a link to open the website to log in, opt to search for the website yourself in a new window to ensure you are logging into the official website.

The researchers also suggest you avoid making quick decisions, based on information given to you at face value. Official channels will almost never ask for personal information over the phone, and you have the right to refuse to disclose that in any situation. This also goes for company information, where possible try to disclose sensitive information in person or through verified secure channels.