A research has claimed that Microsoft, which was involved in the global BSOD outage last week, is among the top 10 global companies vulnerable to phishing attacks.
The vulnerability report titled “Brand Phishing Ranking” for the second quarter of 2024 was recently published by Check Point Research. The ranking highlighted brands such as Microsoft followed by Adidas, WhatsApp and Instagram are most frequently imitated by cybercriminals in their attempts to deceive individuals and steal personal information or payment credentials.
Microsoft Most Vulnerable to Phishing Attacks
Phishing attacks are one of the most common cyber threats and are often the entry point for much larger scale campaigns in a supply chain. According to the vulnerability report, Microsoft was the most imitated brand in phishing attacks for the second quarter this year (Q2 2024), accounting for more than half of all attempts with 57 percent.
“Apple jumped to second spot with 10 percent, moving up from fourth position in the first quarter of 2024, and LinkedIn kept its previous third place ranking with 7 percent of such attempts. Meanwhile, there were new entries to the list with Adidas, WhatsApp, and Instagram moving into the top 10 for the first time since 2022,” the report said.
It added that the technology sector remained the most impersonated industry in brand phishing, followed by social networks and banking sectors. Since technology companies often hold sensitive information, including personal data, financial information, and have access to other accounts, they become valuable targets for attackers.
“Companies such as Microsoft, Google and Amazon, who all appeared on the list, deliver essential and frequently used services such as email, cloud storage, and online shopping. That means people are more likely to respond to messages that appear to be from these critical service providers,” the research pointed out. The research suggested that users should always verify the sender’s email address, avoid clicking on unsolicited links, and enable multi-factor authentication (MFA) on their accounts to protect themselves against phishing attacks. It also recommended that users should use and regularly update security software to help detect and block phishing attempts.
How Cybercriminals Mimic Adidas, Instagram to Deceive Victims
Sharing examples of how cybercriminals carry out phishing attacks by mimicking big brands, the report explained, “For instance, adidasyeezys[.]cz and adidasyeezys[.]it are designed to deceive victims into believing they are authentic Adidas Yeezy sites, closely mimicking the appearance of the legitimate Adidas site.”
“These fraudulent sites are designed to lure users into entering their credentials and personal information, exploiting their resemblance to the original site to successfully steal information. Similarly, adidas-ozweego.fr and adidascampus[.]co[.]at mimic the official Adidas platform,” the report said.
Likewise, the researchers also observed numerous campaigns by cyber criminals using the Instagram brand to perpetrate online scams in the last quarter.
“As a result, Instagram has risen to the 10th position on the list of top brands impacted by phishing, marking its first appearance there since 2022,” said the report.
The report said that bad actors tried to deceive users into divulging their Instagram login credentials on fake domains.
“One instance involves a phishing page hosted at instagram-nine-flame].[vercel].[app/login, which mimics Instagram’s login interface. This page, hosted on Vercel, a platform for creating React applications, prompts users to enter their usernames and passwords,” the report said.
“Another observed campaign utilized the domain instagram-verify-account].[tk. Although currently inactive, it previously displayed a message designed to trick users into entering personal information under the guise of verifying their Instagram accounts. Such tactics aim to exploit trust and deceive users into compromising their credentials,” it concluded.