Abnormal Security, the leading AI-native cloud email security platform, today released its H1 2024 Email Threat Report, revealing how QR code attacks, or “quishing” attacks, have emerged as a popu...
Quishing is on the rise as a novel social engineering attack, while traditional social engineering attacks like BEC and VEC also continue to grow
SAN FRANCISCO: Abnormal Security, the leading AI-native cloud email security platform, today released its H1 2024 Email Threat Report, revealing how QR code attacks, or “quishing” attacks, have emerged as a popular tactic among cybercriminals, with no signs of slowing down.
Although phishing emails have grown in sophistication over time, the end goal has stayed the same: trick targets into divulging sensitive information. QR code attacks are the latest evolution of traditional phishing, where threat actors use social engineering to manipulate targets into interacting with malicious QR codes. In doing so, they may unknowingly provide details that enable the attacker to compromise accounts and launch further attacks.
Targeted QR Code Attacks On the Rise
Examining data collected during the second half of 2023, Abnormal identified attackers’ preferred quishing targets. While every employee is at risk, C-Suite executives were 42 times more likely to receive QR code attacks than the average employee.
Cybercriminals also seem to have a favorite industry to target, with the construction and engineering industry experiencing quishing attacks at a rate 19 times higher than any other vertical. Further, small organizations with 500 or fewer mailboxes also experience these attacks at a rate 19 times higher than any other size company.
In the research report, Abnormal also identified key themes that cybercriminals are using to execute QR code phishing attacks. The most popular are related to multi-factor authentication and access to shared documents—approaches that accounted for 27% and 21% of all QR code attacks respectively. In each of these instances, threat actors attempt to compel recipients to scan a QR code within a fraudulent email, which is linked to a seemingly legitimate website that then prompts the victim to enter login credentials or other sensitive details. The perpetrator can then use the credentials provided to compromise the target’s account and steal data, launch additional attacks, or move laterally to connected applications.
“Leveraging QR codes has become an attractive attack technique for threat actors because they’re effective at evading both human and technology-based detection,” said Mike Britton, chief information security officer at Abnormal. “While employees have long been trained to avoid clicking on suspicious links, QR codes are an emerging and lesser-known malicious tactic that is unlikely to set off the same level of alarm. And unlike traditional email threats, quishing attacks contain minimal text content and no obvious URL, which significantly reduces the number of signals available for legacy security tools to analyze and use to detect an attack.”
BEC and VEC Attacks Continue to Grow
The report also revealed that business email compromise (BEC) and vendor email compromise (VEC) attacks have grown substantially, with BEC doubling in frequency and VEC jumping 50% year-over-year. Additional findings from the Abnormal team include:
Britton continued, “Today’s organizations are feeling the pressure of advanced attacks—both with the rise of emerging tactics like malicious QR codes, and with the continued growth of socially-engineered BEC and VEC attacks. These threats are not only increasing but constantly evolving, targeting organizations and their employees in ways they least expect. Unfortunately, security awareness training is not enough, as these tactics are evolving faster and cybercriminals are finding new methods to prey on human behavior. As such, it’s more important than ever for security leaders to equip their organizations with the most advanced and adaptive threat detection tools to keep pace with, and stay ahead of, modern cybercrime.”
You can download the full H1 2024 Email Threat Report, “Phishing Frenzy: C-Suite Receives 42x More QR Code Attacks Than Average Employee”, here.
You can learn more about how Abnormal Security stops QR code attacks here.
About Abnormal Security
Abnormal Security provides the leading behavioral AI-based email security platform that leverages machine learning to stop sophisticated inbound email attacks and dangerous email platform attacks that evade traditional solutions. The anomaly detection engine leverages identity and context to analyze the risk of every cloud email event, preventing inbound email attacks, detecting compromised accounts, and remediating emails and messages—all while providing visibility into configuration drifts across your environment. You can deploy Abnormal in minutes with an API integration for Microsoft 365 or Google Workspace and experience the full value of the platform instantly, with additional protection available for Slack, Teams, and Zoom. More information is available at abnormalsecurity.com.
Fonte: Business Wire
Scheduled for October, the world's largest startup event will bring together more than 2,000 exhibitors in Dubai, UAE
The Italian IoT company is in the US for the second phase of CALL4INNOVIT
The Italian company partners with MainStreaming for high-performance, energy-efficient video streaming
Software vendors developing vertical solutions against specific attack vectors are 'cool' again. And when it comes to email security, all companies now…
The "New Zealand Buy Now Pay Later Business and Investment Opportunities Databook - Q2 2024 Update" report has been added to ResearchAndMarkets.com's…
The "Kenya Buy Now Pay Later Business and Investment Opportunities Databook - 75+ KPIs on BNPL Market Size, End-Use Sectors, Market Share, Product Analysis,…
Regulatory News: Median Technologies (FR0011049824, ALMDT, PEA/SME eligible, “Median” or “The Company”) will host two live webcasts on September 5, 2024.…
RWS, a unique, world-leading provider of technology-enabled language, content and intellectual property solutions, announces that Mark Lawyer has joined…