A new report from Egress shows that quishing, a phishing method using malicious QR codes, is exploding across the threat landscape in the first three months of 2024.

The practice has skyrocketed: in 2021, quishing only accounted for 0.8% of phishing email payloads, shooting to 10.8% in the past three months alone.

Egress analysts imagine that the trend will continue to proliferate until organisations implement effective countermeasures against this type of attack.

In terms of other phishing payloads, ransomware’s prevalence has doubled since 2021, but malware has seen a significant decline int he same period. Ransomware constitutes about 32.6% of attachment-based payloads, with malware sitting at 30.6%.

Technical evasion techniques appear to be improving: around 20% of phishing emails employed technical measures to evade Microsoft 365 security detection. Further, an unsettling 77.2% of impersonation attacks have been masquerading as well-known brands, including Microsoft.

But attackers are not stopping at just emails: threat actors are using multiple channels, moving from email to Microsoft Teams (30.8%), Slack (19.2%), and SMS (18.6%) after an initial attack.

The threat of AI in the hands of cyber-criminals is a mounting concern for cyber specialists, with nearly two thirds (63%) of cyber leaders concerned about th rise of deepfakes in cyber-attacks, and three fifths (61%) worried about cyber-criminals using generative AI chatbots to enhance their phishing campaigns.

“The one thing that won’t change in 2024 is cyber-criminals investing heavily in attacks that give them the highest rewards,” said Jack Chapman, SVP of threat intelligence at Egress.

Recommended reading

• Ransomware Groups are Adjusting Their Strategies
• Comment | The Rise in QR Code Attacks
• NCSC Warns Ransomware Threat to Rise with AI

“Some tactics will stay the same, but where returns diminish or disappear entirely, new tactics will emerge. Looking at the trends explored in the latest report, we can say with certainty that AI-powered attacks are here to stay.”

With new methods and technology proliferating across the threat landscape, who is being targeted?

Millennials are the primary target for phishing attacks, with GenX close behind. As far as roles go, CEOs are the most targeted, with financial and accounting professionals following.

Threats actors are targeting a range of industries, according to the report, including finance, legal, and healthcare sectors.

Cyber-criminals continue to take advantage of traditional working hours: the report showed that Sunday was the favoured data for phishing emails, with 22% of attacks sent out on this day, followed by Friday at 19%.