Hackers are increasingly using phishing emails with click-bait subject lines to bypass corporate filters and gain access to corporate networks.
Hackers are using phishing emails to take advantage of the fact that in most organisations, humans are still the last line of defence.
A report from KnowBe4, a provider of security awareness training and phishing simulation, has revealed how hackers are gaining access to corporate networks by exploiting the last line of defence- humans. While the concept of phishing isn't new, hackers are still using the technique to appeal to the human psyche and offering what employees need the most.
The report has listed out the top ten phishing email subject lines that hackers have used in the recent past to gain access to corporate networks. These subject lines not only bypass existing corporate filters but also encourage employees to open emails and click on malicious links which open the doors to harmful malware capable of gaining access to and controlling corporate networks.
As many as one in every five phishing emails carry the subject line 'Security Alert'. This subject line is ideal for hackers as it encourages the recipients to find out what's wrong with existing firewalls and also to do something before anything bad happens. 'Security Alert' emails are usually sent out by antivirus firms as well as operating system developers so the chances of them getting caught or filtered are minimal.
Hackers have also extensively used other subject lines like Revised Vacation & Sick Time Policy, Change of Password Required Immediately, Unusual sign-in activity, Urgent Action Required, A Delivery Attempt was made, All Employees: Update your Healthcare Info and A Delivery Attempt was made, all of which carry higher chances of gaining the attention of employees.
Here's the list of the top ten most-clicked phishing email subject lines compiled by KnowBe4 in the order of the number times they were clicked:
1. Security Alert – 21%
2. Revised Vacation & Sick Time Policy – 14%
3. UPS Label Delivery 1ZBE312TNY00015011 – 10%
4. BREAKING: United Airlines Passenger Dies from Brain Haemorrhage – VIDEO – 10%
5. A Delivery Attempt was made – 10%
6. All Employees: Update your Healthcare Info – 9%
7. Change of Password Required Immediately – 8%
8. Password Check Required Immediately – 7%
9. Unusual sign-in activity – 6%
10. Urgent Action Required – 6%
According to Perry Carpenter, Chief Evangelist and Strategy Officer at KnowBe4, phishing emails with such subject lines are easing through corporate filters as they are able to 'find the least effective point of each and playing into the human psyche of wanting to receive something you didn’t know about or needing to intervene before something is taken away.'
The fact that such emails are still landing on employee inboxes with increasing regularity suggests that humans are still 'the last line of defence', he added. In such a scenario, businesses need to take urgent steps to help protect against social engineering tactics that lead to ransomware, CEO fraud, and other phishing-initiated attacks.
The firm also observed that out of 10,000 email servers it evaluated, 82 percent were found to be misconfigured, thus allowing spoofed emails to successfully bypass endpoint security systems. This is another concern that needs to be fixed by businesses at the earliest.