Approximately 250 million phishing redirection attempts were detected by one security firm in 2017.

In Kaspersky Lab’s “Spam and Phishing in 2017” report, the security firm noted that 246,231,645 redirection attempts registered on its system last year — that’s over 91 million more attempts than the previous year. In total, phishers targeted 15.9 percent of Kaspersky Lab users in 2017.

Phishing Attempts and Spam on the Rise in 2017

The report revealed several techniques malicious actors used to enhance their chances of success. For example, scammers purchased free certificates for newly created fraudulent domains or compromised sites already protected by digital certificates. These tactics added legitimacy to their attack websites and helped lure in users. They also relied on punycode encoding, fake cryptocurrency wallets and social media fraud to phish unsuspecting users.

In addition to phishing attempts, scammers sent out a significant amount of spam mail. Kaspersky noted that spam made up more than half (56 percent) of global email traffic in 2017, which is 1.68 percent less than in 2016.

On a more granular level, small spam messages (2 KB and less) were 43 percent of the total, a drop of 18 percent over the previous year. Mail between 20–50 KB made up the second-largest proportion of spam at 21 percent, followed by 10–20 KB at 16 percent, 5–10 KB at 9 percent and 2–5 KB at 5 percent.

Exploiting the Cryptocurrency Craze

As with phishing, spammers incorporated cryptocurrencies into their malicious messages. This effort led to nonexistent seminars, fake cloud mining services and fabricated lottery schemes that included bitcoin and other digital currencies.

Darya Gudkova, spam analyst expert at Kaspersky Lab, predicted that users will see more cryptocurrency-themed email attacks featuring “more cryptocurrency diversity besides bitcoin” in 2018, as quoted by Infosecurity Magazine. She also noted that she expects to see an increase in pump-and-dump schemes.

This rise in phishing and spam attacks will further boost the volume of malicious messages, a number that reached 14.5 billion pieces of mail in 2017, according to AppRiver. As cybercriminals tactics evolve around the cryptocurrency craze and other emerging technologies, users will need to be more cautious than ever when opening unsolicited mail.

More from

2022 Industry Threat Recap: Finance and Insurance

The finance and insurance sector proved a top target for cybersecurity threats in 2022. The IBM Security X-Force Threat Intelligence Index 2023 found this sector ranked as the second most attacked, with 18.9% of X-Force incident response cases. If, as Shakespeare tells us, past is prologue, this sector will likely remain a target in 2023. Finance and insurance ranked as the most attacked sector from 2016 to 2020, with the manufacturing sector the most attacked in 2021 and 2022. What…

X-Force Prevents Zero Day from Going Anywhere

This blog was made possible through contributions from Fred Chidsey and Joseph Lozowski. The X-Force Vulnerability and Exploit Database shows that the number of zero days being released each year is on the rise, but X-Force has observed that only a few of these zero days are rapidly adopted by cyber criminals each year. While every zero day is important and organizations should still devote efforts to patching zero days once a patch is released, there are characteristics of certain…

And Stay Out! Blocking Backdoor Break-Ins

Backdoor access was the most common threat vector in 2022. According to the 2023 IBM Security X-Force Threat Intelligence Index, 21% of incidents saw the use of backdoors, outpacing perennial compromise favorite ransomware, which came in at just 17%. The good news? In 67% of backdoor attacks, defenders were able to disrupt attacker efforts and lock digital doorways before ransomware payloads were deployed. The not-so-great news? With backdoor access now available at a bargain price on the dark web, businesses…

Hack-for-Hire Groups May Be the New Face of Cybercrime

Google’s Threat Analysis Group (TAG) recently released a report about growing hack-for-hire activity. In contrast to Malware-as-a-Service (MaaS), hack-for-hire firms conduct sophisticated, hands-on attacks. They target a wide range of users and exploit known security flaws when executing their campaigns. “We have seen hack-for-hire groups target human rights and political activists, journalists and other high-risk users around the world, putting their privacy, safety and security at risk,” Google TAG says. “They also conduct corporate espionage, handily obscuring their clients’ role.”…