Sextortion, spam, phishing and crypto scams dominated Q3 in email security, with phishing attempts soaring by 30 million, according to Kaspersky Lab.
The Russian AV company’s latest spam and phishing report revealed that its products had blocked 137 million redirects to phishing sites in the period, a 28% increase on the previous quarter.
Global internet portals (32%) and banks (18%) were the most abused types of business in these attacks. In some cases, hackers are taking advantage of the pop-up notifications that some browsers employ.
“It is mainly deployed by websites that collaborate with various partner networks. With the aid of pop-up notifications, users are lured onto ‘partner’ sites, where they are prompted to enter, for example, personal data. The owners of the resource receive a reward for every user they process,” the vendor explained.
“By default, Chrome requests permission to enable notifications for each individual site, and so as to nudge the user into making an affirmative decision, the attackers state that the page cannot continue loading without a little click on the Allow button. The danger is that notifications can appear when the user is visiting a trusted resource.”
Elsewhere, Kaspersky Lab noted the usual phishing ploy of capitalizing on newsworthy events to trick victims into clicking: such as the new iPhone launch.
There’s also been an uptick in phishing attacks targeting global universities for academic research and personal student data. The firm recorded attacks against 131 universities in 16 countries worldwide.
Q3 saw a surge in sextortion spam in which the malicious email uses some of the victim’s real details such as name, password or phone number, which have been bought off the dark web. This lends greater credibility to the emailer, who typically claims they have webcam pics of the user watching pornography and demands a Bitcoin payment to avoid them sending the footage to friends, family and contacts.
Finally, Kaspersky Lab noted a campaign using fake news content designed to trick users into transferring cryptocurrency into an account controlled by the hackers.
The top sources of spam in Q3 were China (13%), the US (11%) and Germany (10%)