Scam Pandemic: How Attackers Exploit Public Fear through Phishing

Bitaab, Marzieh; Cho, Haehyun; Oest, Adam; Zhang, Penghui; Sun, Zhibo; Pourmohamad, Rana; Kim, Doowon; Bao, Tiffany; Wang, Ruoyu; Shoshitaishvili, Yan; Doupé, Adam; Ahn, Gail-Joon

doi:10.1109/ecrime51433.2020.9493260

Cited by 16 publications

(10 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The job of cyber-criminals is made easy by the development of phishing kits, software capable of automatically creating deceptive copies of popular websites [4], [5], [6]. To make things even worse, the COVID-19 pandemic has shifted work, shopping and other activities online which in turn has created new phishing opportunities and increased phishing [7].…”

Section: Introductionmentioning

confidence: 99%

Phishing in Organizations: Findings from a Large-Scale and Long-Term Study

Lain

Kostiainen

Čapkun

2022

2022 IEEE Symposium on Security and Privacy (SP)

View full text Add to dashboard Cite

In this paper, we present findings from a largescale and long-term phishing experiment that we conducted in collaboration with a partner company. Our experiment ran for 15 months during which time more than 14,000 study participants (employees of the company) received different simulated phishing emails in their normal working context. We also deployed a reporting button to the company's email client which allowed the participants to report suspicious emails they received. We measured click rates for phishing emails, dangerous actions such as submitting credentials, and reported suspicious emails.The results of our experiment provide three types of contributions. First, some of our findings support previous literature with improved ecological validity. One example of such results is good effectiveness of warnings on emails. Second, some of our results contradict prior literature and common industry practices. Surprisingly, we find that embedded training during simulated phishing exercises, as commonly deployed in the industry today, does not make employees more resilient to phishing, but instead it can have unexpected side effects that can make employees even more susceptible to phishing. And third, we report new findings. In particular, we are the first to demonstrate that using the employees as a collective phishing detection mechanism is practical in large organizations. Our results show that such crowd-sourcing allows fast detection of new phishing campaigns, the operational load for the organization is acceptable, and the employees remain active over long periods of time.

show abstract

Section: Introductionmentioning

confidence: 99%

Phishing in Organizations: Findings from a Large-Scale and Long-Term Study

Lain

Kostiainen

Čapkun

2022

2022 IEEE Symposium on Security and Privacy (SP)

View full text Add to dashboard Cite

show abstract

“…However, this research shows that this has not been done on a large scale. Researchers, for example Bitaab et al. (2020) , also identified phishing emails impersonating a Covid-19 relief fund.…”

Section: Discussion Of Research Contributionsmentioning

confidence: 99%

The development of phishing during the COVID-19 pandemic: An analysis of over 1100 targeted domains

Hoheisel¹,

Capelleveen²,

Sarmah³

et al. 2023

Computers & Security

View full text Add to dashboard Cite

“…With the remote work scenarios common during COVID-19, phishing attacks have become one of the most significant threats faced by Internet users, organizations, and service providers. The authors of "scam pandemic" [2] describe how attackers exploit public fear through phishing. • DoS: Denial of service (DoS) is an attack affecting legitimate users by making information systems, resources, and devices inaccessible.…”

Section: Nefarious Activity/abusementioning

confidence: 99%

Information Security Threats and Working from Home Culture: Taxonomy, Risk Assessment and Solutions

Kotak

Habler

Brodt

et al. 2023

Sensors

View full text Add to dashboard Cite

During the COVID-19 pandemic, most organizations were forced to implement a work-from-home policy, and in many cases, employees have not been expected to return to the office on a full-time basis. This sudden shift in the work culture was accompanied by an increase in the number of information security-related threats which organizations were unprepared for. The ability to effectively address these threats relies on a comprehensive threat analysis and risk assessment and the creation of relevant asset and threat taxonomies for the new work-from-home culture. In response to this need, we built the required taxonomies and performed a thorough analysis of the threats associated with this new work culture. In this paper, we present our taxonomies and the results of our analysis. We also examine the impact of each threat, indicate when it is expected to occur, describe the various prevention methods available commercially or proposed in academic research, and present specific use cases.

show abstract

Scam Pandemic: How Attackers Exploit Public Fear through Phishing

Cited by 16 publications

References 21 publications

Phishing in Organizations: Findings from a Large-Scale and Long-Term Study

Phishing in Organizations: Findings from a Large-Scale and Long-Term Study

The development of phishing during the COVID-19 pandemic: An analysis of over 1100 targeted domains

Information Security Threats and Working from Home Culture: Taxonomy, Risk Assessment and Solutions

Contact Info

Product

Resources

About