sb-nz logo
Story image

Microsoft top targeted brand by cyber criminals in Q4 2020

At the end of 2020, Microsoft was again the brand most frequently targeted by cyber criminals, according to Check Point Research.

The new Brand Phishing Report for Q4 2020 highlights the brands which were most frequently imitated by criminals in their attempts to steal individuals’ personal information or payment credentials during October, November and December.

In Q4, 43% of all brand phishing attempts related to Microsoft (up from 19% in Q3), as threat actors continued to try to capitalise on people working remotely during the COVID-19 pandemic’s second wave.

DHL maintained its position as the second most impersonated brand, with 18% of all phishing attempts related to it as criminals tried to take advantage of the online shopping season in November and December.

The most likely industry to be targeted by brand phishing was technology, followed by shipping and retail, showing how threat actors are using well-known brands in these sectors to trick users as they grapple with remote working technology and order goods online during peak shopping periods, Check Point states.

As shown in the research, the top 10 brands targeted were Microsoft (related to 43% of all brand phishing attempts globally), DHL (18%), LinkedIn (6%), Amazon (5%), Rakuten (4%), IKEA (3%), Google (2%), Paypal (2%), Chase (2%) and Yahoo (1%).

In a brand phishing attack, criminals try to imitate the official website of a well-known brand by using a similar domain name or URL and web-page design to the genuine site.

The link to the fake website can be sent to targeted individuals by email or text message, a user can be redirected during web browsing, or it may be triggered from a fraudulent mobile application.

The fake website often contains a form intended to steal users’ credentials, payment details or other personal information.

Check Point director Threat Intelligence and Research Maya Horowitz says, “Criminals increased their attempts in Q4 2020 to steal peoples’ personal data by impersonating leading brands, and our data clearly shows how they change their phishing tactics to increase their chances of success."

Check Point Research also highlighted specific phishing email attacks.

During November the researchers noticed a malicious phishing email which used DHL’s branding and was trying to steal users’ passwords.

The email which was sent from the spoofed email address, contained the subject “RE: Your DHL parcel (Available for pick up) – []” with the user’s email.

According to Check Point, the attacker was trying to lure the victim to click on a malicious link, which redirected the user to a fraudulent login page in which the user needed to key in their password, which would then be sent to the site selected by the attacker (https://ipostagepay[.]ru/[.]mm0/).

Another example is a Microsoft credentials theft attempt.

During December the researchers observed a malicious phishing email which was trying to steal credentials of Microsoft Office 365 account users.

The email contained the subject “Doc(s) Daily delivery #-” and the content impersonated eFax service. After the user clicks on the link, they are taken to another document which redirects the user to a fraudulent Microsoft login page.

Horowitz says, “As always, we encourage users to be cautious when divulging personal data and credentials to business applications, and to think twice before opening email attachments or links, especially emails that claim to from companies, such as Microsoft or Google, that are most likely to be impersonated.”

Story image
The mirrored world: Digital twins redefine business intelligence
The world’s most visionary leaders will use technology to master change and shape the future.More
Story image
New wormable Android malware discovered through auto-replies in WhatsApp
Check Point Research has discovered new malware on Google’s Play Store that could spread through WhatsApp messages. More
Story image
Kroll completes Redscan acquisition, expands cyber risk portfolio
With the addition of Redscan and its extended detection and response (XDR) enabled security operations centre (SOC) platform, Kroll expands its Kroll Responder capabilities to support a wider array of cloud and on-premise telemetry sources.More
Story image
Pandemic sees organisations of all sizes and industries invest in CTI
There is opportunity for organisations to better manage their cyber-threat intelligence for greater security and threat intelligence effectiveness by adopting the right tools and processes.More
Story image
Need for greater understanding of data security responsibility as cloud adoption grows - report
Despite the accelerated adoption of cloud services, there was a lack of clarity and confidence regarding the protection and recovery of data stored in public clouds.More
Story image
Microsoft Exchange breach a wake-up call to ditch the server
"There are owners who still have in-house exchange servers because they are suspicious of the cloud or have concerns about their data sovereignty or don't want to contemplate the capital expenditure. But the warning is clear. Get rid of them."More