Phishing attacks rose 29% globally to a new record of 873.9 million attacks observed in the Zscaler cloud last year, with retail and wholesale companies bearing the brunt of the increase.
Zscaler’s ThreatLabz research team analysed data from more than 200 billion daily transactions, and 150 million daily blocked attacks in order to identify emerging threats and track malicious actors from across the globe.
The 2022 ThreatLabz Phishing Report also showed an emerging reliance on “phishing-as-a-service methods,” as well as new attack vectors, such as SMS phishing, becoming one of the more prevalent methods of intrusion.
“Phishing attacks are impacting businesses and consumers with alarming frequency, complexity, and scope — with the rise in phishing-as-a-service making it easier than ever for non-sophisticated actors to launch successful attacks,” said Deepen Desai, CISO and VP of security research and operations at Zscaler.
Desaid said that to defend against advanced phishing attacks, organisations must leverage a multi-pronged defensive strategy anchored on a cloud native zero trust platform that unifies full SSL inspection with AI/ML-powered detection to stop the most sophisticated phishing attempts and phishing kits, lateral movement prevention and integrated deception to limit the blast radius of a compromised user, proactive controls to block high risk destinations such as newly registered domains that are often abused by threat actors, and in-line DLP to safeguard against data theft.
The report found that phishing attacks lure victims by posing as top brands or promoting topical events. The top phishing themes in 2021 included categories such as productivity tools, illegal streaming sites, shopping sites, social media platforms, financial institutions, and logistical services.
In 2021, the United States was the most-targeted country globally, accounting for over 60% of all phishing attacks blocked by the Zscaler security cloud. The next most frequently attacked countries include Singapore, Germany, the Netherlands, and the United Kingdom.
Retail and wholesale businesses experienced an increase of over 400% in phishing attempts — the most out of all tracked industries. These businesses were followed by financial and government sectors, with organisations in these industries seeing over 100% increases in attacks on average.
However, some industries experienced partial relief from phishing attacks last year. Healthcare saw a notable drop of 59%, while the services industry saw a decline of 33%.
Emerging phishing vectors, such as SMS phishing, are increasing faster than other methods as end users become more wary of suspicious emails. Rising phishing activity is directly linked to phishing- as-a-service options, which provide a marketplace of pre-built attack tools that reduce technical barriers to entry for criminals.
