Phishing attacks continue to shatter records through end of 2022

The APWG’s new Phishing Activity Trends Report reveals that 2022 was another record-shattering year for phishing, with the APWG logging more than 4.7 million phishing sites. Since the beginning of 2019, the number of phishing attacks has accelerated, growing at 150 percent per year.

In the fourth quarter of 2022, APWG observed 1,350,037 total phishing attacks. This more than in the third quarter of 2022, when APWG recorded 1,270,883 total phishing attacks, which was a new record at the time and the worst quarter for phishing that APWG has ever observed. APWG recorded 4,744,699 phishing attacks in 2022 — up from 2,847,773 in 2021, 1,845,814 in 2020, and 779,200 in 2019.

APWG Secretary General Peter Cassidy, commenting on the quarter’s findings in the context of recent advances of LLM systems entering the field, said, “The dawn of AICrime is upon us, even before we’ve gotten a grip on conventional phishing. Today, we face robot felons who learn on the job, 24 hours a day, on behalf of their felonious masters. The most forgiving days of our cybercrime epoch may have well have passed.”

In the fourth quarter of 2022, APWG founding member OpSec Security found that phishing attacks against the financial sector, which includes banks, remained the largest set of attacks, accounting for 27.7 percent of all phishing. Phishing against cryptocurrency targets –- such as cryptocurrency exchanges and wallet providers — fell from 4.5 percent in Q2 to 2.0 percent in Q3 and 2.3 percent in Q4, as the crypto market continues to be roiled by falling values.

Matthew Harris, Senior Product Manager, Fraud at OpSec Security, noted: “The logistics and shipping industry saw a large fraud volume increase, specifically because of more attacks against the U.S. Postal Service. We also tracked a huge increase in mobile phone-based fraud, with vishing detection volumes swelling in Q4, more than 40 percent as in Q3.”

During the fourth quarter of 2022, APWG member Fortra monitored “business e-mail compromise” or BEC attacks. Fortra found that attackers requested that victim companies perform wire transfers averaging $132,559 to the attackers. This was up 41 percent from the Q3 average of $93,881. The volume of wire transfer BEC attacks in Q4 decreased by 64 percent compared to the prior quarter.

“This suggests the bad actors behind BEC wire transfer incidents focused their attention on fewer but more impactful attacks,” said John Wilson, Senior Fellow, Threat Research at Fortra.

For report, https://docs.apwg.org//reports/apwg_trends_report_q4_2022.pdf

CT Bureau