The modern workforce is hybrid, and remote work is here to stay. With 80% of companies using cloud or hybrid cloud collaboration tools, it's fertile ground for a cybercriminal to expand the threat surface. Multichannel phishing is becoming the preferred way to deliver these attacks as threat actors exploit security gaps in the hybrid work model. While organizations focus on protecting email from phishing and malware, there are gaps in defenses for other channels. In a recent report on how to respond to the cyberthreat landscape, Gartner warns of the use of multichannel phishing approaches that combine social engineering, vishing, smishing, email, and Web phishing attacks in a single campaign.

Today, 91% of all cyber breaches include a phishing attack because these types of attacks often succeed. Cybercriminals are so successful because these attacks are increasingly sophisticated, zero-hour spear-phishing threats designed specifically to slip past traditional security controls Threats to the mobile channel continue to grow with malicious apps, as well as malicious SMS messages with and without malicious links, spear-phishing, and malicious Web content. Mobile devices are an excellent opportunity because they are less protected, URL inspection is harder on mobile devices, phones have smaller screens than computers, and content is often truncated. Cybercriminals take advantage of distracted users who conduct quick work tasks and transactions, which offers the perfect environment for launching multichannel attacks.

Cybercriminals are capitalizing on digital channels that aid the productivity of remote workers like SMS/text, Slack, LinkedIn, Zoom, Microsoft Teams, Google Meet, and WhatsApp. These channels are less protected and provide an easy way to trick users, steal credentials, and ultimately exfiltrate data from an organization. A growing trend for cybercriminals is to use WhatsApp and SMS to send malicious URLs that appear identical to a Microsoft Teams meeting invite, which they use to harvest Microsoft 365 credentials. This benign invite contains a malicious URL that takes the user to a landing page asking them to enter their Microsoft 365 credentials, and, just like that, a user has given up their login credentials. These credentials now enable the cybercriminal to take over an account and continue to deliver phishing attacks from legitimate services like AWS, Azure, Outlook, and SharePoint.

In most cases, these attacks will bypass most phishing detection tools. SlashNext Threat Labs saw a 57% increase in phishing attacks from trusted services from the fourth quarter of 2021 to the first months of 2022. The trusted reputation of these domains enables cybercriminals to easily evade current detection technologies using domain reputation and blocklists like SEG, proxy, SASE, and endpoint security tools. Attackers use shared services to get around domain reputation technologies with increased frequency. Using mainstream, legitimate commercial infrastructure sites to avoid detection has been a successful tactic, and the growth in these threats continues in 2022.

It's long been known that phishing attacks are getting through gaps in current defenses like secure email gateways, advanced threat protection, and identity graph technology. In addition, some users are accessing corporate tools outside of all security defenses. It should be on every cybersecurity leader's list to address multichannel phishing in 2022. So, how do you know if multichannel phishing is a problem in your organization? Start by assessing the phishing attack surface in your organization. Here are a few questions to get started: Where are your employees protected from phishing? Are they protected when accessing URLs on their browser or their mobile device? Are your users protected from zero-hour threats in real time? Answering no to these questions can indicate that your users and the organization are at risk.

A cyber readiness plan to protect against multichannel phishing should include people, processes, and tools. Ensure the plan includes educating users about the risk of multichannel phishing. Communicate about preventative strategies for how to identify social engineering tactics and suspected compromises. Implement an abuse inbox, and enable alerts for suspicious activity, such as foreign logins. Install security tools that leverage AI and computer vision to detect and block malicious zero-hour threats across email, Web, and mobile.

About the Author

Patrick Harr is CEO of SlashNext, the authority in multichannel phishing and human hacking protection across email, Web, and mobile.