Phishing remains the most dominant and fastest growing internet crime, according to new research from security and performance company, Cloudflare Inc.

This is largely due to the ubiquity of email and the continued issue of human error that is preyed upon by today’s threat actors, according to the company’s 2023 Phishing Threats Report.

While business email compromise (BEC) losses have topped $50 billion, corporate organisations are not the only victims that attackers are after.

The real implications of phishing go beyond Fortune 500’s and global companies, extending to small and local organisations as well as the public sector.

For instance, in this year’s report, Cloudflare observed more email threats targeting political organisations. In the three months leading up to the 2022 US midterm elections, Cloudflare’s email security service found 150,000 phishing email attempts targeting campaign officials.

The report also revealed several trends from 2023, based on 112 billion threats that Cloudflare blocked daily on their global networks. The company evaluated over 279 million email threat idicators, 250 million malicious messages, over 1 billion instances of brand impersonation, and other data points gathered from approximately 13 billion emails between May 2022 and May 2023.

Malicious links were the number one threat category identified in 2023, comprising 35.6% of detected threats.

This was followed by domain age (30%) and identity deception (14.2%). Identify deception was on the rise in 2023, with a year-on-year increase from 10.3%.

Attackers posed as more than 1,000 different organisations in over 1 billion brand impersonation attempts. The majority of the time (51.7%), they impersonated one of 20 well-known brands.

Recommended reading

• WormGPT: Newest Tool in a Phishing Scammer’s Arsenal
• AI: Cyber-friend or Cyber-foe?
• Phishing Attacks on Crypto Wallets Are Getting More Sophisticated

Microsoft was the most impersonated brand, but other major names, including Google, Salesforce, and Norton.so were also consistently impersonated.

Further, the research revealed that email verification proved ineffective at stopping threats. The vast majority (89%) of unwanted messages identified by Cloudflare passed authentication checks.

“Phishing is an epidemic that has permeated into the farthest corners of the Internet, preying on trust and victimising everyone from CEOs to government officials to the everyday consumer,” said Matthew Prince, CEO at Cloudflare.

“Email messages and malicious links are nefarious partners in crime when it comes to the most common form of Internet threats. Organisations of all sizes need a Zero Trust solution that encompasses email security – when this is neglected, they are leaving themselves exposed to the largest vector in today’s threat landscape.”