Who is targeted by email-based phishing and malware?

Abstract

As technologies to defend against phishing and malware often impose an additional financial and usability cost on users (such as security keys), a question remains as to who should adopt these heightened protections. We measure over 1.2 billion email-based phishing and malware attacks against Gmail users to understand what factors place a person at heightened risk of attack. We find that attack campaigns are typically short-lived and at first glance indiscriminately target users on a global scale. However, by modeling the distribution of targeted users, we find that a person's demographics, location, email usage patterns, and security posture all significantly influence the likelihood of attack. Our findings represent a first step towards empirically identifying the most at-risk users.

Untitled

“…Not only is phishing used to facilitate the installation of ransomware, also ransomware is increasingly used to indirectly steal credentials, which sometimes lead to more phishing [50,51]. Another way ransomware leads to phishing is in which the content of the phishing email seems more credible by addressing a recent or on going ransomware attack.…”

“…Their conclusion was that combining ransomware with data-stealing is in general more profitable than ransomware without stealing the data, and that selling the stolen data is always more profitable than threatening to leak the data. Leaked data is often used for semi-targeted and spear-phishing [51]. Therefore this new method of stealing data during a ransomware attack provides additional opportunities for (targeted) phishing.…”

“…There are two ways phishing leads to an increased botnet. One way is to use credentials to automatically install malware [51]. Another is to send a email containing phishing and malware at the same time.…”

Notícias Falsas, Dano Real: Levantamento, Análise e Discussão de Phishing, Malware e Fake News sobre COVID-19

“…Simoiu et al [20] acreditam que apesar da literatura estudar apenas as causas dos ataques por phishing e malware, pode haver uma relação com a existência de um grupo mais propenso a cair em golpes e que são alvos mais frequentes. Foram analisados 1.2 bilhões de phishing e malware enviados pelo GMail durante cinco meses 83 entre abril e agosto de 2020), e que atingiram cerca de 17 milhões de usuários por semana (a maioria das campanhas dura em média apenas 1 dia).…”

“…Os tipos de ataques mais comuns citados por alguns autores são: phishing mail e malware (para [3]); scam e phishig, malware e distributed denial-of-service -DDoS (para [4]); phishing, malware, scamming, e spamming (para [19]); entre outros. Para a grande maioria [15,[20][21][22], phishing e malware seguem como uma das maiores ameaça à segurança, e se tornaram tópico para nossa pesquisa. Conforme Duggal [8], o espaço virtual está tão cheio de informações e desinformações que as pessoas não sabem em qual fonte devem confiar.…”