The Q2, 2022 Brand Phishing Report from cybersecurity firm Check Point shows LinkedIn is still the most impersonated brand in phishing attempts, having first entered into the Top 10 Most Impersonated Brands list in Q1, 2022. There has also been a surge in phishing attempts impersonating Microsoft, which have more than doubled from the previous quarter. The increase has seen Microsoft catapulted into position 2 in the list, accounting for 13% of all brand phishing attempts.
Phishing is a form of social engineering where people are tricked into disclosing sensitive information such as login credentials, personal information, or financial information, and more broadly for the distribution of malware. One of the main ways that individuals are convinced to part with their sensitive data or take other actions that benefit the scammer is by impersonating trusted brands. Phishing emails often spoof well-known companies and use genuine images and direct people to websites that are virtual carbon copies of the websites of the brands being spoofed.
The LinkedIn phishing scams are mostly concerned with obtaining credentials for LinkedIn accounts, which can be used for conducting very realistic spear phishing attacks or for installing malware. The subject lines in these phishing attempts closely mirror those in genuine notifications sent by the professional social media network, including notifications about how many searches an individual has appeared in, a new message that has been received, and requests to do business with the recipient via LinkedIn. These emails can be very convincing, only differing from genuine communications by the email address used, with is totally unrelated to LinkedIn, and the domain of the website that the user is directed to.
One such scam highlighted in the report was a message advising users of the platform that their LinkedIn account will be terminated unless action is taken
New LinkedIn Phishing Campaign. Source: Check Point
The link in the message directs the user to a phishing page where they are asked for personal information.
LinkedIn Phishing Web Page. Source: Check Point
DHL was in third place in Q2, accounting for 12% of all phishing attempts. These phishing campaigns typically notify people about shipping notices and delivery failures, and require the user to disclose sensitive data to obtain information about shipments or to reschedule deliveries. Given the extent to which people use Amazon, it is not surprising to see the online retailer rank highly in the list, achieving position 4 with 9% of all phishing attempts. The top 5 is completed with Apple, which accounted for 3% of all phishing attempts.
Adidas (2%), Google (1%), Netflix (1%), Adobe (1%,) and HSBC (1%), complete the Top 10 List, with Adidas, Adobe, and HSBC all new brands to make it into the quarterly list.