Ninety percent of consumer-focused phishing attacks targeted financial institutions, cloud storage/file hosting sites, webmail and online services, ecommerce sites and payment services in 2015, according to PhishLabs' 2016 Phishing Trends & Intelligence Report.

The good news that came out of the Charleston, S.C.-based PhishLabs' report was the share of overall phishing volume at financial institutions (including payment services firms) declined in 2015. However, it is still the most targeted industry, with 31% of attacks targeting it.

PhishLabs analyzed more than one million confirmed malicious phishing sites in 2015. These sites resided on more than 130,000 unique domains.

”Exploiting the human vulnerability continues to be the most attractive and successful path for threat actors targeting the assets of organizations and individuals,” the report revealed.

For this reason, phishing is the attack method of choice across the adversary spectrum for both novice cybercriminals and advanced cyber operations, PhishLabs said. In addition, techniques for evading automated detection of phishing attacks and preventing analysis of attack components are becoming more commonplace, even among less sophisticated threat actors.

Another key finding in the report was that spear phishing remains the primary initial attack vector used by advanced, persistent threat actors.

In addition, the number of organizations targeted through business email compromise spear phishing attacks grew in 2015, as threat actors refined BEC techniques and sought new victims. More than one fifth, 22%, of spear phishing attacks analyzed in 2015 were motivated by financial fraud or related crimes.

There was also a distinct increase in the percentage of phishing attacks targeting cloud storage and file hosting sites, webmail and online services, and ecommerce sites last year. Phishers focused heavily on online services and ecommerce companies during the holiday season, while other sectors saw a decline in attacks.

Half of all drop email accounts fraudsters use to receive credentials stolen via phishing are Gmail accounts, making Gmail the top cyberattacker webmail service, according to the report. Social media is also a primary promotion and distribution channel for consumer-focused phishing kits.

The business community is definitely on cybercriminals' radar: Over the course of 2015, PhishLabs identified 893 brands from 593 companies targeted through consumer-focused phishing attacks.

As of March 15, the number of breaches captured in the San Diego-based Identity Theft Resource Center's breach report totaled 155 for 2016, up 4.7% from last year's record pace for the same time period (148). The business sector represented almost half of the breaches at 45.8%.

The ITRC report's breakdown of other sectors included medical/healthcare at 34.2%, educational at 11.6%, government/military reporting at 5.8% and banking/credit/financial at only 2.6%.

Instant Insights /

Financial Institutions: Phishers&rsquo; Favorite Targets

Related Stories

Recommended For You

Financial Institutions: Phishers’ Favorite Targets