In a brand phishing attack, cybercriminals try to imitate the official website of a well-known brand by using a similar domain name or URL and web-page design to the genuine site.
The link to the fake website can be sent to targeted individuals by email or text message, a user can be redirected during web browsing, or it may be triggered from a fraudulent mobile application. The fake website often contains a form intended to steal users’ credentials, payment details or other personal information.
According to Check Point Research, Microsoft was the brand most frequently targeted by cybercriminals. The most likely industry to be targeted by brand phishing was technology, followed by shipping and retail, showing how threat actors are using well-known brands in these sectors to trick users as they grapple with remote working technology and order goods online during peak shopping periods.
“Criminals increased their attempts in Q4 2020 to steal peoples’ personal data by impersonating leading brands, and our data clearly shows how they change their phishing tactics to increase their chances of success,” says Maya Horowitz, Director of Threat Intelligence and Research, Products at Check Point.
“As always, we encourage users to be cautious when divulging personal data and credentials to business applications, and to think twice before opening email attachments or links, especially emails that claim to from companies, such as Microsoft or Google, that are most likely to be impersonated.”
Here are the Top 10 phishing brands in 2020
- Microsoft (related to 43% of all brand phishing attempts globally)
- DHL (18%)
- LinkedIn (6%)
- Amazon (5%)
- Rakuten (4%)
- IKEA (3%)
- Google (2%)
- Paypal (2%)
- Chase (2%)
- Yahoo (1%)
