We all like to think we would never fall for a phishing attempt. Unfortunately, none of us are immune because we all make mistakes. Verizon’s 2019 Data Breach Investigations Report showed that nearly one-third (32%) of data breaches involved phishing activity. What’s more, phishing was present in 78% of cyber-espionage incidents and the installation and use of backdoors to networks. It’s no surprise that phishing continues to be a key weapon in cyber-criminals’ arsenals, to try and trick users into giving up sensitive information by impersonating familiar brands.
Brand phishing involves the attacker imitating an official website of a known brand by using a similar domain or URL, and usually a web page similar to the original website. The link to the deceptive website can be sent via email or text message, a user can be redirected during web browsing, or it may be triggered from a fraudulent mobile application. In many cases the website contains a form intended to steal credentials, personal information or payments.
Check Point Research’s latest Brand Phishing Report for Q1 2020 shows that Apple was the most imitated brand, rising from 7th place in Q4 of 2019 to the top spot. This was due in part to the anticipated launch of the new Apple Watch, with criminals exploiting the online buzz to launch several credential theft attempts. The total number of Brand Phishing detections remains stable compared to Q4 of 2019.
Furthermore, in Q1 Mobile Phishing was the second most common attack vector compared to Q4 of 2019 where it ranked in third place. This may be due to the Coronavirus pandemic which has caused people to rely more on their mobile phones for information and work. There are also similarities in the brands being used in web and mobile phishing vectors, such as Netflix and PayPal, which have risen in popularity due to an increase in the number of people working from home as a result of the Coronavirus
The examples below show a series of phishing campaigns which aim to generate direct profit by impersonating Chase, Netflix and other brands.
Top Phishing Brands
Below are the top 10 brands ranked by their overall appearance in brand phishing events during Q1 2020:
Top Phishing brands per platform
During Q1 2020, similar brands were used in mobile and web phishing vectors, which included banking and streaming services such as Chase and Netflix. Web phishing was the most prominent vector at 59%, followed by mobile phishing as the second most common attack vector compared to Q4 of 2019, where it ranked third. This is due to people spending more time on their mobile phones during the Coronavirus pandemic, which cybercriminals are taking advantage of.
Email (18% of attacks)
- Yahoo
- Microsoft
- Outlook
- Amazon
Web (59% of attacks)
- Apple
- Netflix
- PayPal
- eBay
Mobile (23% of attacks)
- Netflix
- Apple
- Chase
Top brands industries
- Technology
- Banking
- Media
Tech in our Time 