The Anti-Phishing Working Group has published its Phishing Activity Trends Report for Q2, 2018. The report has a synopsis and analysis of phishing attacks that were informed to APWG by its member firms and partners between April and June 2018.
The APWG quarterly reports provide insights into the modern phishing trends and demonstrate the level of phishing attacks on companies – Attacks aimed at getting workers to disclose their login identifications, visit malevolent websites, and connect ransomware and malware.
During Q1, 2018, the number of identified phishing sites rose each month from about 60,000 in January to roughly 110,000 in March. In Q2, there was a reverse of this trend with a monthly drop in phishing websites each month to an annual low in June when there were 51,401 phishing sites identified. Although this is definitely good news, June’s figures are still considerably higher than June 2017.
In addition to the drop in identified phishing sites, there has also been a drop in the number of deceived products. 274 products were deceived in April, 285 were deceived in May, but the figure dropped dramatically to 227 deceived brands in June.
In Q2, 2018 an average of 88,161 unique phishing electronic mail reports were transmitted to APWG by its clients. All through 2018, there has been a slight change in the number of informed phishing electronic mails reported each month, with figures varying between about 80,000 and 90,000 each month all through the year.
APWG reports a substantial rise in targeted attacks on software-as-a-service (SaaS) and webmail suppliers in Q2, 2018, which comprised 21% of all phishing attacks. Cybercriminals are trying to gain access to SaaS accounts, Office 365 for instance, to steal confidential company data. Webmail is a common target since compromised electronic mail accounts can be used to transmit spam and additional phishing messages.
Although these attacks are on the rise, the bulk of attacks are on payment processors, banks, and their clients. These attacks comprised 52% of all phishing attacks in Q2, even though there was a slight decline compared to Q1, 2018. Figures from APWG contributor PhishLabs demonstrate the proportion of phishing sites that are safeguarded by the HTTPS encryption protocol is continuing to increase, rising from 33% of sites in Q1, 2018 to just over 35% of sites in Q2. That is a substantial rise from Q4, 2016 when less than 5% of phishing sites used HTTPS and had SSL credentials. The increase reflects the increase in genuine websites that now use HTTPS and have SSL credentials.