The APWG reports in its new Phishing Activity Trends Report that new online payment services and crypto-currency sites are being targeted by phishers. The number of phishing attacks remained high, and the second quarter of 2014 saw the second-highest number of phishing attacks ever recorded in a quarter since the APWG began tracking by quarterly periods in 2008.
The APWG detected an average of 42,793 new phishing attacks per month in the second quarter. The number of targets dropped slightly from 1Q 2014. Year-over-year, the number of targets was down 17 percent from the 639 observed in Q2 of 2013 to the 531 seen in Q2 of 2014. “This indicates a higher concentration of attacks on more vulnerable brands,” said Frederick Felman, Chief Marketing Officer, MarkMonitor, and an APWG contributing member.
Several types of targets were attacked more than in the past. Attacked more frequently were growing online and alternate payment services. Examples include the Austrian cashless payments site PayLife, Hong Kong-based alternate payment system Perfect Money, and Payoneer, an Internet-based financial services business that allows users to transfer money and receive payments through re-loadable prepaid MasterCard debit cards. Attacks against established providers dipped.
“We’re also seeing an uptick in phishing attacks against the users of Bitcoin sites, notably wallet service Blockchain and the exchange site Coinbase,” said Greg Aaron, President of Illumintel and APWG Senior Research Fellow. “The number of attacks against them remains small overall, but we will continue to monitor this as Bitcoin continues to gain adoption by retailers and consumers.”
Attacks against retail/service sites also grew, from 11.5 to 16.5 percent of all phishing attacks. Phishers spoofed these sites because they collect credit card numbers and other useful credentials from their users.
The second quarter also saw a recent increase in the spread of PUPs such as spyware and adware. APWG member company PandaLabs reports that the PUPs were spread by a proliferation of software bundlers: programs that install PUPs on computers along with the programs that the user actually wants to install. Overall, Trojans remained the most common type of malware.
Meanwhile, APWG is convening its fall conference in Birmingham on September 23-25 to address the next generation of cybercrime, specifically inspecting crime engaging fraud architectures in the investing and mortgage banking sectors, as well as advanced research into fraud provenance tracing, programmatic cybercrime event data exchange and enterprise-wide fraud management.
APWG Secretary General Peter Cassidy said, “Account-level cybercrime against consumers and enterprises can damage accounts – but control fraud and investment fraud has the clear potential to damage markets and even economies. Our contributing researchers at this conference are mapping threats-capes that menace commerce and free markets as we know them.”
