A good place to start with phishing awareness training is the phishing emails most likely to fool employees, but what are the most clicked phishing links? What are the types of emails that are resulting in ransomware and malware infections and compromised email accounts? The Q2 2017 phishing report from KnowBe4 reveals all.
Most Clicked Phishing Links Q2, 2017
KnowBe4 is a leading anti-phishing solution provide that offers a platform for training employees, reporting phishing emails and running phishing simulations. Each quarter, the Florida-based company releases a report highlighting the phishing trends and main email-based threats.
This quarter, KnowBe4 has published details of the most clicked phishing email subject lines. Its top ten list is:
- Security Alert (21%)
- Revised Vacation & Sick Time Policy (14%)
- UPS Label Delivery 1ZBE312TNY00015011 (10%)
- BREAKING: United Airlines Passenger Dies from Brain Hemorrhage – VIDEO (10%)
- A Delivery Attempt was made (10%)
- All Employees: Update your Healthcare Info (9%)
- Change of Password Required Immediately (8%)
- Password Check Required Immediately (7%)
- Unusual sign-in activity (6%)
- Urgent Action Required (6%)
As the list clearly shows, the most effective subject lines are those that require urgent action to be taken and prompt end users to open the email and take action quickly without stopping and thinking. All of the above emails made it past organizations’ phishing defenses and filters, even though the subject lines are some of the most commonly used by phishers.
The regularity that emails make it past corporate defenses shows just how important it is for employees to be security aware and trained to recognize phishing threats. As KnowBe4’s chief evangelist and strategy officer Perry Carpenter puts it, “A company’s ‘human firewall’ is an essential element of organizational security because people truly are the last line of defense.”
Carpenter also explained that social media messages also pose a significant threat. The study revealed 44% of social media phishing messages related to LinkedIn. LinkedIn accounts are usually tied to corporate email accounts. Despite the risks, many employees use the same password for their LinkedIn account as for their corporate account. If LinkedIn is compromised, their work email account is compromised.
KnowBe4 also conducted an analysis of corporate email servers. 10,000 were checked and 82% were discovered to have been misconfigured, allowing spoofed emails to be delivered to end users. Ensuring all systems are correctly configured is essential, but if employees are not prepared to deal with phishing threats, they will fall for the scams time and time again, resulting in costly data breaches and significant downtime.