Post Content
Over the years, phishing scams have become more sophisticated, making them harder to detect and block. By leveraging phishing kits and AI tools, even non-technical malicious actors can plan and execute highly targeted phishing campaigns, compromising organizations to access sensitive data for exfiltration and/or extortion.
The Zscaler ThreatLabz 2023 Phishing Report indicates that phishing attackers exploit certain consumer trends by impersonating popular brands to deceive consumers. Malicious e-commerce sites and emails are popular phishing tactics during the holiday season because of the heavy online shopping and spending that occurs during this period.
A widely employed method of phishing involves using trusted domains to exploit unsuspecting consumers, redirecting them to phishing websites. Malicious actors abuse popular online shopping platforms such as Walmart and Amazon in an attempt to collect login credentials. Attackers send free gift cards via email, post ads, or send fake customer service alerts in an attempt to manipulate victims into clicking on phishing links.
In addition to popular online shopping websites, banking and personal finance sites become frequent targets during the holiday season. Some attacks are served over non-secure connections using HTTP and are easy to spot. However, they can also be more elaborate and sophisticated, served over an HTTPS connection with an interface that seems like a legitimate banking and finance website. In 2019, PayPal phishing scams were executed widely by malicious actors. A blog by the Zscaler ThreatLabz team drills into how the threat actors executed the attacks successfully.
In recent years, attackers have also engaged in smishing, i.e., using text messages (SMS communications) to deliver scams, typically with malicious URL links. The message sender appears to be a known e-commerce brand or famous online shopping website. A text message with a tracking link might divert a user to a malicious site that looks legitimate. In the past, Zscaler ThreatLabz has observed these seemingly innocuous websites luring unsuspecting users with polls and surveys that promise monetary rewards
