Microsoft Continues to be Most Imitated Brand for Phishing Attempts in Q1 2021 - Seite 2

In a brand phishing attack, criminals try to imitate the official website of a well-known brand by using a similar domain name or URL and web page design to the genuine site. The link to the fake website can be sent to target individuals by email or text message, a user can be redirected during web browsing, or it may be triggered from a fraudulent mobile application. The fake website often contains a form intended to steal users’ credentials, payment details or other personal information.

Top phishing brands in Q1 2021

Below are the top brands ranked by their overall appearance in brand phishing attempts:

1. Microsoft (related to 39% of all brand phishing attempts globally)
2. DHL (18%)
3. Google (9%)
4. Roblox (6%)
5. Amazon (5%)
6. Wells Fargo (4%)
7. Chase (2%)
8. LinkedIn (2%)
9. Apple (2%)
10. Dropbox (2%)

DHL phishing email – malware example

During the first quarter of 2021, we observed a malicious phishing email that used DHL’s branding and was trying to download the Agent Tesla RAT (Remote Access Trojan) to the user’s machine. The email which was sent from a webmail address and spoofed to appear as if it was sent from [e-mail], contained the subject, “DHL Import Clearance – Consignment : <number>”. The content asked to download an archive file “DHL-IVN.87463.rar”, which contains a malicious executable file that would cause the system to be infected with Agent Tesla.

Wells Fargo phishing email – account theft example

In this phishing email, we see an attempt to steal a user’s Wells Fargo account information. The email which was sent from the spoofed email address [e-mail], contained the subject, “Your Online access has been disabled”. The attacker was trying to lure the victim to click on a malicious link, which redirects the user to a fraudulent malicious page that looks like the real Wells Fargo website . In the malicious link, the user was prompted to key in their username and their password.

Check Point’s Brand Phishing Report is powered by Check Point’s ThreatCloud intelligence, the largest collaborative network to fight cybercrime, which delivers threat data, and attack trends from a global network of threat sensors. The ThreatCloud database inspects over 3 billion websites and 600 million files daily, and identifies more than 250 million malware activities every day.