<\/div>\n

Number of emails related to a two-step targeted campaign detected by Kaspersky solutions (download<\/a>)<\/em><\/p>\n

How a phishing campaign unfolds<\/h3>\n
Attackers send an email in the name of a real trade organization requesting more information about the victim company’s products. The email text looks plausible and has no suspicious elements, such as phishing links or attachments. A sender’s email address from a free domain, like gmail.com, may raise doubts. The email on the screenshot below is sent from an address in this domain, and the company name in the From<\/em> field is different to its name in the signature.<\/p>\n
$\"Example$ <\/a><\/p>\n
Example of the first email<\/em><\/strong><\/p>\n
It is worth noting that the use of free domains is not typical for spear phishing in the name of organizations, because such domains are rarely used in business. Most often in targeted attacks, attackers either use spoofing of the legitimate domain<\/a> of the organization they are pretending to be, or register domains similar to the original one. In addition, Google and Microsoft are pretty quick in blocking email addresses spotted sending spam. This is the most likely reason why attackers used different addresses in the From<\/em> header (where the email came from) and Reply-to<\/em> header (where the reply will go when clicking “Reply” in your email client). This means the victim responds to another address, which may be located in another free domain, such as outlook.com. The address in the Reply-to<\/em> header is not used for spam, and correspondence with it is initiated by the victim, so it is less likely to be blocked quickly.<\/p>\n
After victims respond to a first email, attackers send a new message, asking them to go to a file-sharing site and view a PDF file with a completed order, which can be found via the link.<\/p>\n
$\"An$ <\/a><\/p>\n
An email with a phishing link<\/em><\/strong><\/p>\n
By clicking the link, the user is taken to a fake site generated by a well-known phishing kit. It is a fairly simple tool that generates phishing pages to steal credentials from specific resources. Our solutions blocked fake WeTransfer and Dropbox pages created with this kit.<\/p>\n
$\"A$ <\/a><\/p>\n
A fake WeTransfer page created using the same phish kit as the target campaign sites<\/em><\/strong><\/p>\n
In the phishing campaign described above, the phishing site mimics a Dropbox page with static file images and a download button. After clicking any element of the interface, the user is taken to a fake Dropbox login page that requests valid corporate credentials.<\/p>\n
$\"A$ <\/a><\/p>\n
A fake Dropbox page<\/em><\/strong><\/p>\n
$\"Login$ <\/a><\/p>\n
Login page with a phishing form<\/em><\/strong><\/p>\n
When victims attempt to log in, their usernames and passwords are sent to https:\/\/pbkvklqksxtdrfqkbkhszgkfjntdrf[.]herokuapp[.]com\/send-mail.<\/p>\n
<form name=\"loginform\">\r\n <div class=\"form-group\">\r\n <label for=\"\">Email Address<\/label>\r\n <input type=\"email\" id=\"email\" class=\"form-control\" name=\"email\" placeholder=\"email Address\">\r\n <div class=\"email-error\"><\/div>\r\n <\/div>\r\n <div class=\"form-group\">\r\n <label for=\"\">Password<\/label>\r\n <input type=\"password\" id=\"password\" class=\"form-control\" name=\"password\" placeholder=\"Password\">\r\n <div class=\"password-error\"><\/div>\r\n <\/div>\r\n <div class=\"form-group btn-area\">\r\n <button class=\"download-btn\" id=\"db\" type=\"submit\">Download<\/button>\r\n <\/div>\r\n <\/form>\r\n <\/div>\r\n <script src=\"https:\/\/firebasestorage.googleapis.com\/v0\/b\/linktopage-c7fd6.appspot.com\/o\/obfuscated.js?alt=media&token=1bb73d28-53c8-4a1e-9b82-1e7d62f3826b\"><\/script>\r\n<\/pre>\n
HTML representation of a phishing form<\/em><\/strong><\/p>\n
Victims<\/h3>\n
We have identified targets for this campaign around the world, including the following countries: Russia, Bosnia and Herzegovina, Singapore, USA, Germany, Egypt, Thailand, Turkey, Serbia, Netherlands, Jordan, Iran, Kazakhstan, Portugal, and Malaysia.<\/p>\n
Statistics: spam<\/h2>\n
Share of spam in mail traffic<\/h3>\n
In 2022, an average of 48.63% of emails worldwide were spam, representing a 3.07 p.p. increase on 2021. Over the course of the year, however, the share of spam in global email traffic has gradually declined, from 51.02% in the first quarter to 46.16% in the fourth.<\/p>\n
<\/div>\n
Share of spam in global email traffic, 2022 (download<\/a>)<\/em><\/p>\n
The most active month in terms of spam was February 2022, with junk traffic accounting for 52.78% of all email correspondence. June was in second place (51.66%). December was the calmest, only 45.20% of emails in this month were spam.<\/p>\n
On Runet, the proportion of spam in email traffic is generally higher than worldwide. In 2022, an average of 52.44% of emails were junk mailings. At the same time, the trend for a gradual shift in ratio in favor of legitimate correspondence can also be seen. We saw the largest share of spam in Runet in the first quarter, with 54.72% of all emails, and by the fourth quarter it had dropped to 49.20%.<\/p>\n
<\/div>\n
Proportion of spam in Runet email traffic, 2022 (download<\/a>)<\/em><\/p>\n
Even though the second quarter (53.96%) was quieter in terms of spam than the first, the most active month in the Russian segment of the internet was June (60.16%). Most likely, the share of spam in June, both in Russia and globally, was influenced by the surge in mailings with offers from Chinese factories that we observed in that month. And the quietest month in Runet was December (47.18%), the same as globally.<\/p>\n
Countries and territories \u2014 sources of spam<\/h3>\n
In 2022, the share of spam from Russia continued to grow, from 24.77% to 29.82%. Germany (5.19%) swapped places with mainland China (14.00%), whose share increased by 5.27 percentage points. Third place is still held by the United States (10.71%).<\/p>\n
<\/div>\n
TOP 20 countries and territories \u2014 sources of spam, 2022 (download<\/a>)<\/em><\/p>\n
The Netherlands remained in fifth place (3.70%), its share decreased compared to 2021. Sixth and seventh places went to Japan (3.25%) and Brazil (3.18%), whose shares rose by 0.89 and 3.77 p.p., respectively. Next come the UK (2.44%), France (2.27%) and India (1.82%).<\/p>\n
Malicious mail attachments<\/h3>\n
In 2022, our Mail Anti-Virus detected 166,187,118 malicious email attachments. That’s an increase of 18 million from the previous year. This component caused most triggers in March, May, and June 2022.<\/p>\n
<\/div>\n
Number of Mail Anti-Virus hits, January \u2014 December 2022 (download<\/a>)<\/em><\/p>\n
The most common malicious email attachments in 2022, as in 2021, were Agensla<\/a> Trojan stealers (7.14%), whose share decreased slightly. Noon<\/a> spyware (4.89%) moved up to second place, and Badun<\/a> Trojans (4.61%) spreading as archived electronic documents moved down to third place. The fourth most common malware were vulnerability exploits CVE-2018-0802<\/a> (4.33%) in Microsoft Equation Editor. In 2022, attackers used them significantly more often than CVE-2017-11882<\/a> exploits in the same component (1.80%). This vulnerability was more widespread in 2021 and has now dropped to tenth place.<\/p>\n
<\/div>\n
TOP 10 malware families spread by email attachments in 2022 (download<\/a>)<\/em><\/p>\n
ISO<\/a> Trojans (3.27%), sent in the form of disk images, moved up to number five, and the sixth most common was the Guloader<\/a> downloader family (2.65%), which delivers remotely controlled malware to victims’ devices. They are closely followed by the Badur<\/a> family (2.60%), PDF files containing links to web resources with questionable content, and in eighth place is the infamous Emotet<\/a> botnet (2.52%). Law enforcement shut this down in early 2021, but by fall, attackers had restored the infrastructure and were actively distributing it in 2022. More recently, Emotet has been used to deliver other malware to victims’ devices, particularly ransomware. The ninth most popular family was Taskun<\/a> (2.10%), which creates malicious tasks in the task scheduler.<\/p>\n
<\/div>\n
TOP 10 types of malware spread by email attachments in 2022 (download<\/a>)<\/em><\/p>\n
The list of the most common malware sent via email usually corresponds to the list of families. As in 2021, attackers mostly distributed the same instances from the TOP 10 families.<\/p>\n
Countries and territories targeted by malicious mailings<\/h3>\n
Spain remains the leader in terms of blocked malicious attachments in 2022 (8.78%), which is a slight decrease compared to 2021 (9.32%). The share of Russia (7.29%), on the other hand, increased slightly. Third place went to Mexico (6.73%), and fourth place to Brazil (4.81%), whose share was virtually unchanged from the previous reporting period.<\/p>\n
<\/div>\n
TOP 20 countries and territories targeted by malicious mailings, 2022 (download<\/a>)<\/em><\/p>\n
In Italy, 4.76% of all detected malicious attachments were blocked in 2022. The country is followed by Vietnam (4.43%) and Turkey (4.31%). The percentage of Mail Anti-Virus detections on computers of users from Germany (3.85%) continued to decrease. The share in the United Arab Emirates (3.41%) also decreased slightly, dropping to ninth place, while Malaysia (2.98%) remained in tenth place.<\/p>\n
Statistics: phishing<\/h2>\n
In 2022, the number of phishing attacks increased markedly. Our Anti-Phishing system prevented 507,851,735 attempts to follow a phishing link, roughly double the number in 2021.<\/p>\n
Map of phishing attacks<\/h3>\n
In 2022, the geography of phishing attacks changed dramatically. Attempts to click phishing links were most often blocked on devices from Vietnam (17.03%). In 2021, this country was not among the TOP 10 most attacked countries and territories. Macau is in second place (13.88%), also absent from last year’s ranking. Madagascar is in third place (12.04%), which was seventh in 2021. In addition to Vietnam and Macau, Algeria (11.05%), Malawi (10.91%) and Morocco (10.43%) appeared at the top of the list of most attacked countries and territories. Ecuador (11.05%) moved up to fifth place, while Brunei (10.59%) dropped one place to seventh. Brazil (10.57%) and Portugal (10.33%) moved from first and third places to eighth and tenth, respectively, and France, which was second in 2021, left the TOP 10.<\/p>\n
TOP 10 countries and territories by share of attacked users:<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Country\/territory<\/strong><\/td>\n Share of attacked users*<\/strong><\/td>\n<\/tr>\n
Vietnam<\/td>\n 17.03%<\/td>\n<\/tr>\n
Macau<\/td>\n 13.88%<\/td>\n<\/tr>\n
Madagascar<\/td>\n 12.04%<\/td>\n<\/tr>\n
Algeria<\/td>\n 11.05%<\/td>\n<\/tr>\n
Ecuador<\/td>\n 11.05%<\/td>\n<\/tr>\n
Malawi<\/td>\n 10.91%<\/td>\n<\/tr>\n
Brunei<\/td>\n 10.59%<\/td>\n<\/tr>\n
Brazil<\/td>\n 10.57%<\/td>\n<\/tr>\n
Morocco<\/td>\n 10.43%<\/td>\n<\/tr>\n
Portugal<\/td>\n 10.33%<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
* Share of users encountering phishing out of the total number of Kaspersky users in that country\/territory, 2022<\/em><\/strong><\/p>\n
Top-level domains<\/h3>\n
As in previous years, the majority of phishing pages were hosted in the COM domain zone, but its share almost halved, from 31.55% to 17.69%. Zone XYZ remained in second place (8.79%), whose share also decreased. The third most popular domain among attackers was FUN (7.85%), which had not previously received their attention. The domain is associated with entertainment content, which is perhaps what attracted fraudsters to it.<\/p>\n
<\/div>\n
Most frequent top-level domains for phishing pages in 2022 (download<\/a>)<\/em><\/p>\n
Domains ORG (3.89%) and TOP (1.80%) swapped places relative to 2021 but remained in fourth and fifth places. In addition to this, the top ten domain zones in most demand among cybercriminals included: RU (1.52%), COM.BR (1.13), DE (0.98%), CO.UK (0.98%) and SE (0.92%).<\/p>\n
Organizations under phishing attacks<\/h3>\n
The rating of organizations targeted by phishers is based on the triggering of the deterministic component in the Anti-Phishing system on user computers. The component detects all pages with phishing content that the user has tried to open by following a link in an email message or on the web, as long as links to these pages are present in the Kaspersky database.<\/em><\/p>\n
In 2022, pages impersonating delivery services had the highest percentage of clicks on phishing links blocked by our solutions (27.38%). Online stores (15.56%), which were popular with attackers during the pandemic, occupied second place. Payment systems (10.39%) and banks (10.39%) ranked third and fourth, respectively.<\/p>\n
<\/div>\nDistribution of organizations targeted by phishers, by category, 2022 (download<\/a>)<\/em><\/p>\n
The share of global internet portals (8.97%) almost halved, with almost as many phishing resources targeting users of smaller web services (8.24%). Social networks (6.83%), online games (2.84%), messengers (2.02%) and financial services (1.94%) round complete the TOP 10 categories of sites of interest to criminals.<\/p>\n
Hijacking Telegram accounts<\/h3>\n
In 2022, our solutions stopped 378,496 phishing links aimed at hijacking Telegram accounts. Apart from a spike in phishing activity throughout June, when the number of blocked links exceeded 37,000, the first three quarters were relatively quiet. However, by the end of the year, the number of phishing attacks on the messenger’s users increased dramatically to 44,700 in October, 83,100 in November and 125,000 in December. This increase is most likely due to several large-scale Telegram account hijacking campaigns that we observed in late 2022<\/a> (article in Russian).<\/p>\n
<\/div>\n
Number of clicks on phishing links aimed at hijacking a Telegram account worldwide, and in Russia specifically, January \u2014 December 2022 (download<\/a>)<\/em><\/p>\n
It is of note that the majority of phishing attacks were aimed at users from Russia. While in the first months of 2022 their share was approximately half of the total number of attacks worldwide, since March 70\u201390% of all attempts to follow phishing links by Telegram users were made by Russian users.<\/p>\n
Phishing in messengers<\/h3>\n
Statistics on messenger-based phishing are based on anonymized data from the Safe Messaging component of Kaspersky Internet Security for Android, voluntarily provided by users of this solution. Safe Messaging scans incoming messages and blocks attempts to follow any phishing or otherwise malicious links in them.<\/em><\/p>\n
In 2022, our mobile solution blocked 360,185 attempts to click on phishing links from messengers. Of these, 82.71% came from WhatsApp, 14.12% from Telegram and another 3.17% from Viber.<\/p>\n
<\/div>\nDistribution of links blocked by the Safe Messaging component, by messenger, 2022 (download<\/a>)<\/em><\/p>\n
Phishing activity on WhatsApp is down slightly since 2021. On average, the Safe Messaging component blocked 816 clicks on fraudulent links per day. The first half of the year was the most turbulent, and by the third quarter, phishing activity in the messenger had dropped sharply.<\/p>\n
$\"Dynamics$ <\/a><\/p>\n
Dynamics of phishing activity on WhatsApp in 2022 (weekly number of detected links shown)<\/em><\/strong><\/p>\n
The largest number of phishing attempts on WhatsApp, approximately 76,000, was recorded in Brazil. Russia is in second place, where over the year, the Chat Protection component prevented 69,000 attempts to go to fraudulent resources from the messenger.<\/p>\n
<\/div>\nTOP 7 countries and territories where users most often clicked phishing links in WhatsApp (download<\/a>)<\/em><\/p>\n
Unlike WhatsApp, the number of phishing attacks on Telegram almost tripled in 2022 compared to the previous reporting period. On average, our solutions blocked 140 attempts to follow phishing links in this messenger per day. The peak of activity came at the end of June and beginning of July, when the number of blocked clicks could have exceeded 1,500 per week. Phishing activity on Telegram also increased sharply at the end of the year.<\/p>\n
$\"Dynamics$ <\/a><\/p>\n
Dynamics of phishing activity on Telegram in 2022 (weekly number of detected links shown)<\/em><\/strong><\/p>\n
In Russia, we recorded the largest number (21,000) of attempts to click a link to fraudulent resources from Telegram. Second place went to Brazil, where 3,800 clicks were blocked.<\/p>\n
<\/div>\nTOP 7 countries and territories where users most frequently clicked phishing links from Telegram (download<\/a>)<\/em><\/p>\n
Conclusion<\/h2>\n
Times of crisis create the preconditions for crime to flourish, including online. Scams promising compensation and payouts from government agencies, large corporations and banks are likely to remain popular among cybercriminals next year. The unpredictability of the currency market and departure of individual companies from specific countries’ markets will likely affect the number of scams associated with online shopping. At the same time, the COVID-19 topic, popular with cybercriminals in 2020 and 2021, but already beginning to wane in 2022, will finally cease to be relevant and will be replaced by more pressing global issues.<\/p>\n
Recently, we’ve seen an increase in targeted phishing attacks where scammers don’t immediately move on to the phishing attack itself, but only after several introductory emails where there is active correspondence with the victim. This trend is likely to continue. New tricks are also likely to emerge in the corporate sector in 2023, with attacks generating significant profits for attackers.<\/p>\n","protected":false},"excerpt":{"rendered":"
Statistics on spam and phishing with the key trends in 2022: two-stage spear phishing, hijacking of social network and instant messaging accounts, import substitution, and survey phishing.<\/p>\n","protected":false},"author":299,"featured_media":108793,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[918],"tags":[685,459,682,458,453,723,3124,1053,1305,112,126,78,200,1052,451,544],"banners":"","hreflang":[{"hreflang":"x-default","url":"https:\/\/securelist.com\/spam-phishing-scam-report-2022\/108692\/"}],"_links":{"self":[{"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/posts\/108692"}],"collection":[{"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/users\/299"}],"replies":[{"embeddable":true,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/comments?post=108692"}],"version-history":[{"count":11,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/posts\/108692\/revisions"}],"predecessor-version":[{"id":108794,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/posts\/108692\/revisions\/108794"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/media\/108793"}],"wp:attachment":[{"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/media?parent=108692"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/categories?post=108692"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/tags?post=108692"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

Phishing in 2022<\/h2>\n

Spam in 2022<\/h2>\n

Statistics: spam<\/h2>\n

Country\/territory<\/strong><\/td>\n	*Share of attacked users<\/strong><\/td>\n<\/tr>\n**
Vietnam<\/td>\n	17.03%<\/td>\n<\/tr>\n
Macau<\/td>\n	13.88%<\/td>\n<\/tr>\n
Madagascar<\/td>\n	12.04%<\/td>\n<\/tr>\n
Algeria<\/td>\n	11.05%<\/td>\n<\/tr>\n
Ecuador<\/td>\n	11.05%<\/td>\n<\/tr>\n
Malawi<\/td>\n	10.91%<\/td>\n<\/tr>\n
Brunei<\/td>\n	10.59%<\/td>\n<\/tr>\n
Brazil<\/td>\n	10.57%<\/td>\n<\/tr>\n
Morocco<\/td>\n	10.43%<\/td>\n<\/tr>\n
Portugal<\/td>\n	10.33%<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n * Share of users encountering phishing out of the total number of Kaspersky users in that country\/territory, 2022<\/em><\/strong><\/p>\n Top-level domains<\/h3>\n As in previous years, the majority of phishing pages were hosted in the COM domain zone, but its share almost halved, from 31.55% to 17.69%. Zone XYZ remained in second place (8.79%), whose share also decreased. The third most popular domain among attackers was FUN (7.85%), which had not previously received their attention. The domain is associated with entertainment content, which is perhaps what attracted fraudsters to it.<\/p>\n <\/div>\n Most frequent top-level domains for phishing pages in 2022 (download<\/a>)<\/em><\/p>\n Domains ORG (3.89%) and TOP (1.80%) swapped places relative to 2021 but remained in fourth and fifth places. In addition to this, the top ten domain zones in most demand among cybercriminals included: RU (1.52%), COM.BR (1.13), DE (0.98%), CO.UK (0.98%) and SE (0.92%).<\/p>\n Organizations under phishing attacks<\/h3>\n The rating of organizations targeted by phishers is based on the triggering of the deterministic component in the Anti-Phishing system on user computers. The component detects all pages with phishing content that the user has tried to open by following a link in an email message or on the web, as long as links to these pages are present in the Kaspersky database.<\/em><\/p>\n In 2022, pages impersonating delivery services had the highest percentage of clicks on phishing links blocked by our solutions (27.38%). Online stores (15.56%), which were popular with attackers during the pandemic, occupied second place. Payment systems (10.39%) and banks (10.39%) ranked third and fourth, respectively.<\/p>\n <\/div>\nDistribution of organizations targeted by phishers, by category, 2022 (download<\/a>)<\/em><\/p>\n The share of global internet portals (8.97%) almost halved, with almost as many phishing resources targeting users of smaller web services (8.24%). Social networks (6.83%), online games (2.84%), messengers (2.02%) and financial services (1.94%) round complete the TOP 10 categories of sites of interest to criminals.<\/p>\n Hijacking Telegram accounts<\/h3>\n In 2022, our solutions stopped 378,496 phishing links aimed at hijacking Telegram accounts. Apart from a spike in phishing activity throughout June, when the number of blocked links exceeded 37,000, the first three quarters were relatively quiet. However, by the end of the year, the number of phishing attacks on the messenger’s users increased dramatically to 44,700 in October, 83,100 in November and 125,000 in December. This increase is most likely due to several large-scale Telegram account hijacking campaigns that we observed in late 2022<\/a> (article in Russian).<\/p>\n <\/div>\n Number of clicks on phishing links aimed at hijacking a Telegram account worldwide, and in Russia specifically, January \u2014 December 2022 (download<\/a>)<\/em><\/p>\n It is of note that the majority of phishing attacks were aimed at users from Russia. While in the first months of 2022 their share was approximately half of the total number of attacks worldwide, since March 70\u201390% of all attempts to follow phishing links by Telegram users were made by Russian users.<\/p>\n Phishing in messengers<\/h3>\n Statistics on messenger-based phishing are based on anonymized data from the Safe Messaging component of Kaspersky Internet Security for Android, voluntarily provided by users of this solution. Safe Messaging scans incoming messages and blocks attempts to follow any phishing or otherwise malicious links in them.<\/em><\/p>\n In 2022, our mobile solution blocked 360,185 attempts to click on phishing links from messengers. Of these, 82.71% came from WhatsApp, 14.12% from Telegram and another 3.17% from Viber.<\/p>\n <\/div>\nDistribution of links blocked by the Safe Messaging component, by messenger, 2022 (download<\/a>)<\/em><\/p>\n Phishing activity on WhatsApp is down slightly since 2021. On average, the Safe Messaging component blocked 816 clicks on fraudulent links per day. The first half of the year was the most turbulent, and by the third quarter, phishing activity in the messenger had dropped sharply.<\/p>\n $\"Dynamics$ <\/a><\/p>\n *Dynamics of phishing activity on WhatsApp in 2022 (weekly number of detected links shown)<\/em><\/strong><\/p>\n* The largest number of phishing attempts on WhatsApp, approximately 76,000, was recorded in Brazil. Russia is in second place, where over the year, the Chat Protection component prevented 69,000 attempts to go to fraudulent resources from the messenger.<\/p>\n *<\/div>\n*TOP 7 countries and territories where users most often clicked phishing links in WhatsApp (download<\/a>)<\/em><\/p>\n Unlike WhatsApp, the number of phishing attacks on Telegram almost tripled in 2022 compared to the previous reporting period. On average, our solutions blocked 140 attempts to follow phishing links in this messenger per day. The peak of activity came at the end of June and beginning of July, when the number of blocked clicks could have exceeded 1,500 per week. Phishing activity on Telegram also increased sharply at the end of the year.<\/p>\n $\"Dynamics$ <\/a><\/p>\n *Dynamics of phishing activity on Telegram in 2022 (weekly number of detected links shown)<\/em><\/strong><\/p>\n* *In Russia, we recorded the largest number (21,000) of attempts to click a link to fraudulent resources from Telegram. Second place went to Brazil, where 3,800 clicks were blocked.<\/p>\n* *<\/div>\n*TOP 7 countries and territories where users most frequently clicked phishing links from Telegram (download<\/a>)<\/em><\/p>\n Conclusion<\/h2>\n Times of crisis create the preconditions for crime to flourish, including online. Scams promising compensation and payouts from government agencies, large corporations and banks are likely to remain popular among cybercriminals next year. The unpredictability of the currency market and departure of individual companies from specific countries’ markets will likely affect the number of scams associated with online shopping. At the same time, the COVID-19 topic, popular with cybercriminals in 2020 and 2021, but already beginning to wane in 2022, will finally cease to be relevant and will be replaced by more pressing global issues.<\/p>\n Recently, we’ve seen an increase in targeted phishing attacks where scammers don’t immediately move on to the phishing attack itself, but only after several introductory emails where there is active correspondence with the victim. This trend is likely to continue. New tricks are also likely to emerge in the corporate sector in 2023, with attacks generating significant profits for attackers.<\/p>\n","protected":false},"excerpt":{"rendered":" Statistics on spam and phishing with the key trends in 2022: two-stage spear phishing, hijacking of social network and instant messaging accounts, import substitution, and survey phishing.<\/p>\n","protected":false},"author":299,"featured_media":108793,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[918],"tags":[685,459,682,458,453,723,3124,1053,1305,112,126,78,200,1052,451,544],"banners":"","hreflang":[{"hreflang":"x-default","url":"https:\/\/securelist.com\/spam-phishing-scam-report-2022\/108692\/"}],"_links":{"self":[{"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/posts\/108692"}],"collection":[{"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/users\/299"}],"replies":[{"embeddable":true,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/comments?post=108692"}],"version-history":[{"count":11,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/posts\/108692\/revisions"}],"predecessor-version":[{"id":108794,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/posts\/108692\/revisions\/108794"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/media\/108793"}],"wp:attachment":[{"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/media?parent=108692"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/categories?post=108692"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/tags?post=108692"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}