Smishing attacks surged exponentially in 2021 - Report

The annual Human Factor report, published by enterprise security company Proofpoint, reveals that SMS phishing, also known as smishing, has doubled in 2021 as cyber-criminals looked to exploit human error to compromise devices.

The report is based on a review of more than 2.6 billion email messages, 49 billion URLs, 1.9 billion attachments, 28 million cloud accounts, 1.7 billion mobile messages, and various other data points.

According to Proofpoint, the rise in smishing could be due to changing personal habits. Because most consumers now use their devices for work, cybercriminals have spotted a "two-for-one" opportunity. Fake delivery notifications were involved in more than half of the smishing lures in the UK.

A rise in telephone-based threats, such as tech support scams and vishing attempts to spread malware to users’ computers or devices, was also revealed in the report.

Typically, such attacks begin with unsolicited emails posing as legitimate sources and urging the recipient to contact a helpline. The victim is directed to a malicious call center when dialing that number.

The Proofpoint study also revealed that supply chains continue to threaten businesses. Every month, over 80% of businesses are attacked by a compromised supplier account, according to the report, which also recommends that organizations improve security awareness training around these threats.

According to the report, attacks on privileged users pose a risk to organizations. Despite accounting for only 10% of users, managers and executives account for nearly half of all attacks or "severe risk." Departments dealing with sensitive information, such as human resources (HR) or finance, are more likely to be targeted.

According to the report, knowing where the highest privilege-based risks exist, either individually or across departments, is critical in defending any organization against attack. High-privilege users can get extra training to deal with the increased threat. Additional layers of security or oversight may be beneficial to departments dealing with sensitive or valuable data.