A Summary of Phishing, Malware, Mobile and Social Media Cybercrime in 2014
2014 saw an evolution of cybercrime attacks, involving highly targeted, sophisticated campaigns against large organisations. We will take a look at the trends of a few of the attack methods in 2014.
Phishing:
The standard phishing methods used for the past 10 years continue to yield results for criminals, and FraudWatch International have observed an increase in this basic phishing targeting growing digital economies as Internet banking take up from consumers continues to rise at a rapid rate in Asian and African countries.
In more established countries, phishing techniques are evolving as criminals seek to avoid detection by security companies and spam filters. Highly targeted spear phishing of consumers based on other personal information gathered online has become increasingly successful, some in combination with phone calls to the consumer, to help build trust, resulting in better returns for the criminals.
Non-financial online sectors have received increased attention from phishing criminals, including online retail brands with large consumer reach, airline reward programs, health care and online gaming. Criminals are either impersonating these brands to gain credit card information, or simply using the phishing attacks to gather more personal information to be used for a spear phishing attack.
Mobile Apps:
As global smartphone use continues to rise, the number of fake mobile apps increased significantly in 2014. Many of these fake apps allow the criminal to control the smartphone, intercept data or sessions, or simply capture personal information to send to the criminals, including account login information. We have also seen an increase in adware apps included within the download of genuine apps.
In 2014, FraudWatch International saw many brands, both large and small, targeted with fake mobile app attacks targeting their users, some attacks saw hundreds of fake apps released at the same time on various genuine app stores, as well as app directory sites with direct downloads.
Malware:
Financial Institution targeted malware has become increasingly sophisticated, as criminals seek to maximise their timeframe of zero-day detection. Many financial institutions are now targeted with more malware attacks than phishing attacks. Criminals are now changing their malware delivery, execution and control methods on a daily basis to avoid detection from AV and security companies.
Malware infects a user’s device, and steals login credentials, allows criminals to hijack Internet banking sessions, change DNS entries to facilitate pharming, and even bypass multi-factor authentication methods used by Financial Institutions.
Social Media:
Companies are now using social media as one of the main methods of communication with their consumers. Criminals have taken to social media, create profiles to impersonate both recognizable brands, and the executives of those brands. Fake social media profiles can be used for many different reasons by criminals. FraudWatch International have seen a large number of cases intended to cause reputational damage to the targeted brands.
In the second half of 2014, FraudWatch International saw a 50% increase in the number of fake social media profiles impersonating brands.
All organisations, both large and small, should expect their brand to be abused by criminals online. The response of the organization will have a direct impact on future attacks. Early detection and take down of this abuse will minimize the impact both to the organization and its consumers, and the return on investment by the criminals.
Stay in touch next week: we will be looking at the expected trends for 2015.