Cloud and Threat Report:
January 2025

Phishing generally takes the form of an attacker creating a fake login page for a website, using a tool to reverse proxy a login page, or making a fake application to trick the victim into authorizing access. Over the past year, the number of users clicking on phishing links has increased by nearly triple, from 2.9 in 2023 to 8.4 out of every 1,000 users in the average organization clicking on a phishing link each month. This increase comes despite most organizations requiring users to undergo security awareness training to avoid phishing attacks. The main factors leading to this increase are cognitive fatigue (with users constantly being bombarded with phishing attempts) and the creativity and adaptability of the attackers in delivering harder-to-detect baits.

The top target for phishing campaigns that users clicked on in 2024 were cloud applications, representing over one-quarter of the clicks. Attacker objectives vary depending on the target:

• Cloud – Attackers aim to sell stolen account access on illicit marketplaces, where the buyer will use it for business email compromise, to steal data, or to pivot to other more high-value victims.
• Banking – Banking institutions are targeted for financial fraud.
• Telco – Telecommunication providers are targeted for fraud or to sell access to stolen accounts.
• Social Media – Social media accounts can be used by low-level actors to propagate scams and spread malware or by sophisticated adversary groups to spread disinformation and misinformation.
• Government – The most common government phishing target is the Internal Revenue Service in the United States, where financial information is requested to pay out a tax refund.

The most targeted brand among cloud apps is Microsoft, where attackers target Microsoft Live and 365 credentials. Pages targeting Yahoo and AOL are similar, explicitly targeting login credentials for those apps. However, the fake Adobe and DocuSign pages are slightly different, as illustrated in the screenshots below the graph: The phishing pages use the Adobe and DocuSign brands to target credentials for other services. To ensure no one is left out, the attackers in both examples even include an “other” option where the victim can enter any email address and password. In both of these examples and most others, Microsoft 365 is among the target credentials. As a result, the percentage of users clicking on links targeting Microsoft credentials is closer to 75%. Microsoft’s popularity as a phishing target is unsurprising because Microsoft 365 is the most popular productivity suite by a large margin.

Where the victims are encountering the phishing links provides clues as to why the number of users clicking on such links may have increased in the past year. The majority of the clicks did not come from email but rather from various other locations throughout the web. The top referrer was search engines, where attackers run malicious ads or use SEO poisoning techniques to get the phishing pages listed at the top of the search engine results for specific terms. Other top referrers included shopping, technology, business, and entertainment sites, where the referrals come from comments, malicious ads, and infected sites. The variety of phishing sources illustrates some creative social engineering by attackers. They know their victims may be wary of inbound emails (where they are repeatedly taught not to click on links) but will much more freely click on links in search engine results.

1.4 out of every 100 people encountered malicious content on the web or in the cloud each month during 2024. The most common types of content encountered were JavaScript-based Trojans. These malicious scripts aim to trick the victim into downloading malware, visiting another malicious scam or phishing site, or authorizing access to their accounts. Below is a list of the top 10 most commonly encountered malware families, all designed to trick their victims into downloading, opening, or clicking something to kick off a series of cascading events designed to compromise their systems. Blocking Trojans is crucial because they are often the initial vector for more sophisticated malicious activities, including espionage, ransomware, financial fraud, and sabotage.

Backdoor.Zusy (a.k.a. TinyBanker) is a banking Trojan based on Zeus’s source code that aims to steal personal information via code injection into websites.

Downloader.Nemucod is a JavaScript downloader that has previously delivered Teslacrypt.

Downloader.SLoad (a.k.a Starslord) is a downloader often used to deliver Ramnit.
Downloader.Upatre is a downloader that distributes other payloads, such as Locky and Dridex.

Infostealer.AgentTesla is a .NET-based remote access Trojan with many capabilities, including stealing passwords from the browser, logging keystrokes, and capturing clipboard contents.

Trojan.CobaltStrike is a powerful commercial penetration testing framework that enables various functionalities, including a highly customizable command and control framework to evade traditional network-based detection. Cracked versions of CobaltStrike are widely used by many adversary groups.

Trojan.FakeUpdater (a.k.a. SocGholish) is a JavaScript downloader that delivers various payloads, including Dridex and Azorult.