Brand impersonation is back in the news. A major threat to businesses, this troubling trend looks set to continue its upward trajectory as a popular ploy of the bad guys into 2022. Masquerading as a trustworthy correspondent is one of the oldest tricks in the book for a reason: it works. It’s still a go-to for cybercriminals as well because it tends to be effective. Employees are likely to approach messages from trusted brands that they interact with frequently like Microsoft or Amazon with a higher degree of trust that cybercriminals can leverage to slip malicious messages past their defenses.

Brand impersonation had the big year 2021, bringing fresh danger to employee inboxes. The Verizon Data Breach Investigations Report 2021 shows the rapid rise of brand impersonation, called Misrepresentation in this instance, clocking in 15 times higher than it did in 2020. The DBIR notes that this growing category is an aspect of social engineering and a direct precursor to business email compromise attacks. Continued reliance on email as remote work continues and increasing sophistication of phishing messages is a powerful combination for trouble from brand impersonation scams. Employees encounter this threat frequently – 25% of all branded emails that companies receive are spoofed or brand impersonation attempts.

While brand impersonation isn’t a scheme that changes a great deal in substance, the brands that cybercriminals enjoy impersonating do. New data about the most imitated brands of 2021 shows a few changes in the lineup that reflect the impact of the pandemic. The new champion at the end of 2021 was DHL, the star of about 23% of all phishing attacks. That’s a change, traditionally Microsoft tops the list. But they didn’t fall far from their usual dominance. Microsoft clocked in at number two at 20%, followed by WhatsApp at 11% and Google at 10%.  A few steps off the leaderboard finds other common brands that cybercriminals favor: WhatsApp (11%), Google (10%), LinkedIn (8%), Amazon (4%), Roblox (3%), FedEx (3%), PayPal (2%) and Apple (2%). Facebook (now Meta) dropped out of the list.

Microsoft has long been the cybercriminal go-to for brand impersonation and spoofing. Phishing with attachments is a familiar foe for IT professionals. It’s long been a staple of malicious email attachments as well. Employees handle a lot of Office files. That’s why they made up  48% of malicious email attachments in an email traffic study.  Microsoft Office formats like Word, PowerPoint, and Excel are also popular file extensions for cybercriminals to use when transmitting malware via email, accounting for 38% of phishing attacks. The next most popular delivery method: archived files such as .zip and .jar, which account for about 37% of malicious transmissions.

One thing that stands out on that list is the increasing prominence of social media phishing, especially when looking at brand fraud and impersonation scams. Social media is an ideal stage for brand impersonation, especially chat apps. Worldwide the number of social media users was about 4.5 billion in 2021, and cybercriminals would love to reach every single one of them. Companies in every field are flocking to social media ads and taking advantage of the medium’s dominance to get their messages in front of potential customers. An estimated 96% of SMBs use social media as part of their marketing strategy. Cybercriminals are going to follow the crowd because that’s how they follow the money, and social media use is now a regular part of just about everyone’s daily life. In January 2021, organizations experienced about 34 social-media-related phishing attacks per month. That number ballooned by September 2021 when organizations were looking at 61 social-media-related phishing attacks per month – a shocking 82% increase in just three quarters. While phishing is not the only cyberattack that comes to a company’s doorstep via social media, it’s certainly the most common.

Everyone is sending a lot of emails these days. If email volume continues to trend the way that experts expect, it is estimated to reach over 376.4 billion daily messages by 2025.  That increase in email volume has given the bad guys a wealth of opportunities to pursue phishing. An estimated 80% of IT professionals said that their organizations have faced an increase in the number of phishing attacks that they’re combatting in 2021. Unfortunately, more phishing attempts have translated into more phishing attack disasters for many companies.  An estimated 74% of respondents in the same survey said that their companies had been successfully phished in the last year.

Plus, brand impersonation and spoofing can be especially tricky for employees to detect. Those messages are often highly sophisticated, and that’s bad news for businesses – 97% of employees cannot recognize sophisticated phishing threats. Some of that lack of skill can be chalked up to a lack of security awareness training that leaves employees unsure of themselves when they’re confronted with a possible phishing email or even oblivious to the threat a phishing message represents. Another reason is social engineering. Many employees are afraid they’ll miss an important message or make the wrong move in providing information to a client or superior – setting their employers up for trouble.

Source: Id Agent