Cybercriminals have been leveraging lookalike domains in cyberattacks such as Business Email Compromise (BEC), phishing, and online fraud campaigns. Recently, Bolster has evaluated the use of fraudulent sites by cybercriminals.
A peek into recent trends
Researchers observed an increase in fraudulent websites using local events and occasions, such as Amazon Prime Day, and the presidential election to lure the victims.
- In Q3, there has been a significant change in the sectors targeted by cybercriminal activity. The attackers have become more focused on e-commerce services (accounting for 34.70% of domains), followed by IT and telecom (22.20%), and product and mining (13.90%).
- According to Bolster, approximately 4,000 new phishing and fraudulent websites are created every month using the top 10 brands including Microsoft, Apple, and PayPal, among others.
Domain spoofing attacks on government websites
- Recently, hackers had registered numerous FBI-related domains indicating the potential for future operational activity.
- Last month, hackers were discovered spoofing US Census Bureau domains for future malicious campaigns, including phishing and credential theft attacks.
The bottom line
Lack of awareness and timely actions have widened the scope of spoofed websites for brand impersonation. The frequency and success rate of spoofed domains have truly become a major risk for brands. Experts recommend organizations to be careful and vigilant by avoiding suspicious and unknown links and checking the domains to identify lookalike phishing pages.
Source: https://cyware.com/news/domain-based-phishing-and-spoofing-scams-put-pedal-to-the-metal-b8ef46b3
