KnowBe4 has announced the results of its Q3 top-clicked phishing report.
“Social engineering attacks continue to be one of the top ways malicious hackers breach organisations and/or cause damage,” said Stu Sjouwerman, CEO, KnowBe4. “We are seeing a continued increase in phishing, including more use of common HR types of communications and less reliance on obvious social media phishing campaigns. By equipping security professionals with more data on likely tactics and templates used by cybercriminals executing phishing attacks, infosec professionals can strengthen their human firewall. Now more than ever, end users need to remain vigilant and remember to stop and think before they click.”
TOP 10 EMAIL CATEGORIES GLOBALLY
- Business
- Online Services
- Human Resources
- IT
- Banking and Finance
- Coronavirus/COVID-19 Phishing
- Mail Notifications
- Phishing for Sensitive Information
- Social Networking
- Brand Knockoffs
Top phishing email subjects were also broken out, comparing those in the U.S. to those in Europe, the Middle East and Africa (EMEA). In Q3 2021, KnowBe4 examined tens of thousands of email subject lines from simulated phishing tests. In the U.S., most of the email subjects appear to originate from the users’ organisation. However, in EMEA, the top subjects are related to users’ everyday tasks. The organisation also reviewed ‘in-the-wild’ email subject lines that show actual emails users received and reported to their IT departments as suspicious. The results are below.
TOP PHISHING EMAIL SUBJECTS:
The U.S.
- Vacation Policy Update
- Password Check Required Immediately
- Important: Dress Code Changes
- Acknowledge Your Appraisal
- Remote Working Satisfaction Survey
EMEA
- Your Document is Complete – Save Copy
- Stefani has endorsed you!
- You have requested a reset to your LinkedIn password
- Windows 10 Upgrade Error
- Internet Capacity Warning
*Capitalisation and spelling are as they were in the phishing test subject line.
**Email subject lines are a combination of both simulated phishing templates created by KnowBe4 for clients, and custom tests designed by KnowBe4 customers.
COMMON “IN-THE-WILD” ATTACKS:
- IT: Odd emails from your account
- IT: Upcoming Changes
- HR: Remote Working Satisfaction Survey
- Facebook: Your Facebook access has been temporarily disabled for identity check
- Twitter: Potential Twitter Account Compromise
*Capitalisation and spelling are as they were in the phishing test subject line.
**In-the-wild email subject lines represent actual emails users received and reported to their IT departments as suspicious. They are not simulated phishing test emails.
