Enterprise users are constantly targeted with Trojans from many different angles. Adversaries are continuously crafting new Trojans with a variety of different baits to trick users into downloading and executing them. In 2023, an average of 8 out of every 10k users downloaded an average of 11 Trojans per month. Throughout the year, an organization with 10k users would have had an average of 132 Trojans downloaded by users on their network. Netskope Threat Labs expects both of these numbers to remain relatively constant throughout 2024.

One of the angles that adversaries increasingly use to trick users into downloading Trojans is to host the Trojans on popular SaaS apps. Over the past year, the percentage of HTTP and HTTPS malware downloads originating from SaaS apps has been consistently above 50%, a trend that Netskope Threat Labs expects to continue through 2024 as it pushes closer toward 60%.

The specific apps where adversaries have the most success in tricking their victims into downloading Trojans are unsurprisingly also some of the most popular apps in the enterprise. The following figure breaks down the top 20 apps, including a year-over-year comparison. We highlight four major themes of this plot below.

Microsoft OneDrive maintains its lead
As discussed earlier in this report, Microsoft OneDrive is ubiquitous in the enterprise. It is the most popular SaaS app by a large margin, with nearly two-thirds of all enterprise users accessing content in OneDrive every month. For that reason, it is unsurprising that it would also lead in terms of malware downloads. Adversaries can easily create their own OneDrive accounts to host malware, which they share with their victims. Furthermore, because two-thirds of users regularly use OneDrive, they are accustomed to clicking on OneDrive links and therefore more likely to do so when an adversary shares one.

Microsoft Sharepoint is nuanced
Microsoft leverages SharePoint in a variety of other services, including Microsoft Teams. The year-over-year increase in malware downloads originating from SharePoint is primarily due to an increase in Trojans being shared with victims over Microsoft Teams, which show up as Microsoft SharePoint downloads on the Netskope platform.

Apps providing free hosting are the leaders
The majority of the apps in the top 20 are apps that provide free file hosting services. This includes cloud storage apps (Microsoft OneDrive, Google Drive, Azure Blob Storage, Amazon S3, Box, Dropbox, Google Cloud Storage), free web hosting apps (Weebly, Squarespace), free file sharing services (DocPlayer, MediaFire, WeTransfer), and free source code hosting apps (GitHub, SourceForge). Because these apps all provide low-cost or no-cost file hosting, Netskope Threat Labs expects them and similar apps to continue to be abused for malware and phishing delivery for the foreseeable future.

Adversaries are generally more successful in tricking victims into clicking on phishing links than they are in tricking them into downloading malware. On average, 29 out of every 10k enterprise users clicked on a phishing link each month in 2023, more than three times the rate of users downloading Trojans. Throughout the year, an organization with 10k users would have had an average of 348 users clicking on phishing links.

Attackers phish for credentials and other sensitive information for a variety of different targets. The top 10 phishing targets in 2023 included popular cloud and SaaS applications, shopping sites, and banking portals. SaaS apps and shopping sites were among the top targets throughout the year, while banking portals, social media, and government targets saw a steady increase throughout the year. While some adversaries phish for credentials and data that they will themselves use, others serve as initial access brokers, selling the stolen credentials, banking information, and other data on the black market. Netskope Threat Labs predicts that cloud and SaaS apps, while they will continue to remain among the top phishing targets, will be displaced by banking portals as the top target in early 2024.

Among the top phishing target categories, there were a few standouts:

Secteur public
The most common government target was the United States Internal Revenue Service, where attackers created phishing pages to steal financial data from their victims.

Social Media
Facebook, the most popular social media app in the enterprise, remains the most targeted social media platform by a large margin. Adversaries use compromised social media accounts to run scams, spread malware, spread misinformation, and other illicit activities.

Shopping
The shopping giants Amazon and Ebay remain the top shopping targets.

Gaming
The gaming platform Steam was the most targeted gaming platform by a large margin. Adversaries typically use the payment information attached to the account to make purchases and also try to use the account to compromise additional accounts.

Consumer
The video streaming service Netflix maintained its lead as the most phished service in the consumer category in 2023. Here, the main objective is theft: The stolen accounts are sold on a black market to people looking for an inexpensive Netflix subscription.

Among the cloud and SaaS apps targeted by adversaries in phishing campaigns in 2023, one app ecosystem stands out above all the rest: Microsoft. Microsoft’s popularity among enterprise users means that Microsoft credentials are both a lucrative target for attackers and that users are going to be more accustomed to clicking on links for Microsoft services. As more users continue to use Microsoft services, Microsoft will continue to be a primary target of adversaries who can leverage access to their victim’s Microsoft account for business email compromise, to steal sensitive data, and to pivot to other connected applications. For these reasons, Netskope Threat Labs expects Microsoft to remain the top cloud phishing target in 2024, increasing its lead even further over other apps.

A less common but growing phishing strategy is to use phishing attachments instead of phishing links in emails. Phishing attachments are meant to bypass anti-phishing controls that only inspect links embedded directly in the email itself. The most common type of phishing attachment is a PDF document that appears to be an invoice, directing victims to call a phone number or visit a link if they need to correct anything on the invoice. Phishing attachments were quite rare in early 2022, spiked mid-year, subsided, and spiked again in late 2023. Despite the increase, an enterprise user downloading a phishing attachment is less common than a user clicking a phishing link or downloading a Trojan. Netskope Threat Labs expects phishing attachments to become even more common in 2024.