Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Phishers Target Social Media

Financial institutions still the number one target, according to a new report by RiskIQ.

Social media platforms now rank as one of the most phished brands, right behind financial institutions, according to a new report.

The RiskIQ Q4 Phishing Roundup report also has some good news: The number of blacklisted phishing domains declined 2% from Q3. The number of brands targeted was also down to 259, a drop of 7% in the same time.

But social media has graduated to the Big Time: this was the first quarter where social media platforms were among the top targeted brands for threat actors.

Sam Curcuruto, head of product marketing at RiskIQ, says that phishing actors will always stay "close to the money," but that they're finding that money is following the social media trail. Curcuruto says phishers use social media as an attack vector and to phish log-in credentials: they use the stolen credentials to log into the social media accounts to learn more about the consumer so they can craft more targeted and effective spear-phishing attacks.

Phishing attacks targeting social media accounts aren't new, however. In RiskIQ's Q3 Report, 10% of phishing targets were social media platforms, Curcuruto says. By Q4, though, a full 20% of attacks were against social media targets, putting social media on an equal footing with large tech company and digital transaction provider targets.

Financial institutions still lead the target pack with 40% of targeted domains, but the rise of social media is striking.

Curcuruto says that social media's contribution to a full picture of the phishing target is one reason for the increase in phishing activity. "You can learn a lot about someone by looking at the information on one of those accounts, so you can start to do things like get around authentication questions," Curcuruto says. The other is the rise in social media capabilities for transferring funds from one party to another, making social media "close to the money," in Curcuruto's words.

While broad media attention has shifted to computer actors' involvement with political and election issues, Curcuruto says that he doesn't see anything in the trends to indicate that phishing attackers will re-focus their attention. "When you think about phishing, it all comes down to the money, so I'm not entirely sure we'll see a lot of phishing affected by things like the upcoming elections," he says. "I think that in the next quarter we'll see financial institutions remaining the top target."

New research from Kaspersky Lab seems to confirm that financial targets are at the top of phishing criminals lists. Attacks against banks, payment systems, and online retailers made up the top three categories in overall phishing attacks in 2017, a sign that criminals are now focusing on accessing money directly, according to the security vendor.

RiskIQ's Curcuruto says there's another new phishing target emerging as well: cryptocurrency wallets. "We're seeing an increase in cryptocurrency, so I think we'll see more phishing aimed at cryptocurrency wallets," Curcuruto says. "I think we'll see people using these [wallets] who aren't familiar with the security behind them, so we'll see more phishing."

Phishing remains an active attack method, with 27,285 uniquely blacklisted phishing domains spotted in Q4. This despite consumers and businesses becoming more diligent in defending against phishing attacks. "People are becoming more and more educated about the phishing threat, so fewer are being successful," Curcuruto says, though phishers are becoming more sophisticated in their attacks in response.

Two-factor authentication is another defense strategy making an impact on phishing success. "The more the platforms move to 2FA, the more difficult it is for a [phishing] attempt to be successful," Curcuruto says.

Related Content:

 

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
97% of Americans Can't Ace a Basic Security Test
Steve Zurier, Contributing Writer,  5/20/2019
TeamViewer Admits Breach from 2016
Dark Reading Staff 5/20/2019
How a Manufacturing Firm Recovered from a Devastating Ransomware Attack
Kelly Jackson Higgins, Executive Editor at Dark Reading,  5/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Could you pass the hash, I really have to use the bathroom!
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-9892
PUBLISHED: 2019-05-22
An issue was discovered in Open Ticket Request System (OTRS) 5.x through 5.0.34, 6.x through 6.0.17, and 7.x through 7.0.6. An attacker who is logged into OTRS as an agent user with appropriate permissions may try to import carefully crafted Report Statistics XML that will result in reading of arbit...
CVE-2019-10066
PUBLISHED: 2019-05-22
An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6, Community Edition 6.0.x through 6.0.17, and OTRSAppointmentCalendar 5.0.x through 5.0.12. An attacker who is logged into OTRS as an agent with appropriate permissions may create a carefully crafted calendar appointment i...
CVE-2019-10067
PUBLISHED: 2019-05-22
An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6 and Community Edition 5.0.x through 5.0.35 and 6.0.x through 6.0.17. An attacker who is logged into OTRS as an agent user with appropriate permissions may manipulate the URL to cause execution of JavaScript in the context...
CVE-2019-6513
PUBLISHED: 2019-05-21
An issue was discovered in WSO2 API Manager 2.6.0. It is possible for a logged-in user to upload, as API documentation, any type of file by changing the extension to an allowed one.
CVE-2019-12270
PUBLISHED: 2019-05-21
OpenText Brava! Enterprise and Brava! Server 7.5 through 16.4 configure excessive permissions by default on Windows. During installation, a displaylistcache file share is created on the Windows server with full read and write permissions for the Everyone group at both the NTFS and Share levels. The ...