PHISHING ACTIVITY TRENDS REPORT

4 Quarter
2022
thUnifying theGlob a l Re sp onse
T o Cyb er cr ime

Table of Contents
Statistical Highlights for 2nd Quarter 2017

3Phishing E-mail Reports and Phishing Site Trends

4Brand-Domain Pairs Measurement

5Brands & Legitimate Entities Hijacked byE-mail Phishing Attacks

6

Use of Domain Names for Phishing

7-9

Phishing and Identity Theft in Brazil

10-11

Most Targeted Industry Sectors

12

APWG Phishing Trends Report Contributors

13Activity October - December 2022

Published 9 May 2022

Phishing Activity Trends Report, 4th Quarter 2022

Phishing Report Scope
The APWG Phishing Activity Trends Report analyzes
phishing attacks and other identity theft techniques, asreported to the APWG by its member companies, its
Global Research Partners, through the organization’s
website at http://www.apwg.org, and by e-mailsubmissions to reportphishing@antiphishing.org. APWG
measures the evolution, proliferation, and propagation ofidentity theft methods by drawing from the research ofour member companies and industry experts.

Phishing Reaches New
Quarterly High in Late 2022

Phishing Attacks, Jan 2019 toDec 2022
500,000

Phishing Defined

400,000

Phishing is a crime employing both social engineering andtechnical subterfuge to steal consumers’ personal identity
data and financial account credentials. Social engineering
schemes prey on unwary victims by fooling them into
believing they are dealing with a trusted, legitimate
party, such as by using deceptive email addresses andemail messages. These are designed to lead consumers tocounterfeit Web sites that trick recipients into divulging
financial data such as usernames and passwords.
Technical subterfuge schemes plant malware ontocomputers to steal credentials directly, often using
systems that intercept consumers’ account usernames
and passwords or misdirect consumers to counterfeit
Web sites.

200,000

300,000

100,000
Jan-19Apr-19Jul-19Oct-19Jan-20
Apr-20Jul-20
Oct-20Jan-21
Apr-21
Jul-21
Oct-21
Jan-22
Apr-22
Jul-22Oct-220

The year 2022 was another record-shattering year for phishing,with the APWG logging more than 4.7 million attacks

Phishing Activity Trends Summary•

Table of Contents
Statistical Highlights

3

Most-Targeted Industry Sectors

5Business E-mail Compromise (BEC)

8Email-Based Threats

7APWG Phishing Trends Report Contributors

8About the APWG

9••••2Phishing Activity Trends Report
4th Quarter 2022
www.apwg.org • info@apwg.org

2022 was a record year for phishing, with
the APWG logging more than 4.7 million
attacks. Since the beginning of 2019, thenumber of phishing attacks has grown by
more than 150% per year. [pp. 3-4]
The 101,104 unique email subjects received
in October 2022 was the single largest
month sample APWG had ever seen. [p. 3]
The APWG observed 1,350,037 total
phishing attacks in Q4 2022. This was upslightly from the record third quarter, when
APWG recorded 1,270,883 total phishingattacks. [pp. 3-4]
Attacks against the financial sector
represented 27.7% of all phishing attacks.
[p. 5]
Business Email Compromise (BEC) attacks
continued to menace enterprises. The
average BEC attack attempted to steal$132,559. [p. 6]

Phishing Activity Trends Report, 4th Quarter 2022
Statistical Highlights for the 4th Quarter 2022
APWG’s contributing members study the ever-evolving nature and techniques of cybercrime. APWG has
two sources of phishing data: phishing emails reported to it by APWG members and by members of thepublic, and phishing URLs reported by APWG members into the APWG eCrime eXchange.
The APWG tracks:•Unique phishing sites. This is a primary measure of reported phishing across the globe. This isdetermined by the unique bases of phishing URLs found in phishing emails reported to APWG’srepository. (A single phishing site may be advertised as thousands of customized URLs, allleading to basically the same destination.) Thus, APWG measures reported phishing sites, which
is a more relevant metric than URLs. A synonym for sites is attacks.

•Unique phishing e-mails subjects. This counts email lures that have different email subject lines.
Some phishing campaigns may use the same subject line but advertise different phishing sites.
This metric is a general measure of the variety of phishing attacks, and can be a rough proxy forthe amount of phishing taking place.

•The APWG also counts the number of brands attacked by examining the phishing reports
submitted into the APWG eCrime Exchange, and normalizing the spellings of brand names.
OctoberNovember

DecemberNumber of unique phishing Web sites (attacks) detected

440,508450,390459,139

Unique phishing email subjects

101,104

77,46974,250

599

610

577

Number of brands targeted by phishing campaigns

In the fourth quarter of 2022, APWG observed 1,350,037 total phishing attacks. This was up slightly fromthe third quarter, when APWG recorded 1,270,883 total phishing attacks, which was a new record at thetime and the worst quarter for phishing that APWG has ever observed. In 4Q 2022, APWG also received
increased phishing email submissions from its members and the public. The 101,104 unique email subjects
received in October 2022 was the largest APWG had seen.

3

Phishing Activity Trends Report
4th Quarter 2022
www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 4th Quarter 2022
In general, the number of phishing sites seen each month climbed across 2022:

Phishing Attacks, 2022
500,000
450,000
400,000
350,000
300,000
250,000
200,000

150,000
100,000
50,000
0Jan-22 Feb-22 Mar-22 Apr-22 May-22 Jun-22 Jul-22 Aug-22 Sep-22 Oct-22 Nov-22 Dec-22

Looking across four years, APWG has seen steep increases, accelerating to more than 150% per year:

Phishing Attacks, Jan 2019 to Dec 2022
500,000
450,000
400,000
350,000
300,000
250,000
200,000
150,000
100,000
50,000

Phishing Activity Trends Report
4th Quarter 2022
www.apwg.org • info@apwg.org

Sep-22

Nov-22

Jul-22Mar-22

May-22

Jan-22

Nov-21

Sep-21

Jul-21

May-21

Jan-21

Mar-21

Sep-20Nov-20Jul-20Mar-20May-20Jan-20Nov-19Sep-19Jul-19

May-19Jan-194Mar-190

Phishing Activity Trends Report, 4th Quarter 2022
Most-Targeted Industry Sectors – 4th Quarter 2022
In the fourth quarter of 2022, APWG founding member OpSec Security found that phishing attacks
against the financial sector, which includes banks, remained the largest set of attacks, accounting for 27.7
percent of all phishing, up from 23.2 percent in Q32022. Attacks against webmail and software-as-aservice (SAAS) providers were next in prominence, at 17.7 percent, declining slightly from Q3. Attacks
against payment processors such as PayPal, Venmo, and VISA accounted for another 6 percent.
Phishing against social media companies trended downward, after fluctuating from 8.5 percent of all
attacks in 4Q2021 to 15.5 percent in 2Q2022. Phishing against cryptocurrency targets –- such as cryptocurrency exchanges and wallet providers — fell from 4.5 percent in Q2 to 2.0 percent in Q3 and 2.3
percent in Q4, as the crypto market continued to be roiled by falling values.
Matthew Harris, Senior Product Manager, Fraud at OpSec Security, noted: “The logistics and shipping
industry saw a large fraud volume increase, specifically because of more attacks against the U.S. Postal
Service. We also tracked a huge increase in mobile phone-based fraud, with vishing detection volumes
swelling in Q4, more than 40 percent as in Q3.”

MOST-TARGETED INDUSTRIES, 4Q2022
Social Media , 10.4%

Logistics / Shipping , 9.0%

Payment , 6.0%
eCommerce / Retail ,5.6%
Other , 18.2%
Telecom, 3.1%

Cryptocurrency , 2.3%

SAAS / Webmail ,17.7%

OpSec Security offers world-class brand protection solutions.

5Phishing Activity Trends Report
4th Quarter 2022
www.apwg.org • info@apwg.org

Financial Institution ,27.7%

Phishing Activity Trends Report, 4th Quarter 2022
Business e-Mail Compromise (BEC), 4th Quarter 2022
APWG member Agari by Fortra tracks the identity theft technique known as “business e-mail compromise”
or BEC, which has caused aggregate losses in the billions of dollars, at large and small companies. In a BEC
attack, a scammer impersonates a company employee or other trusted party, and tries to trick an employee
into sending money, usually by sending the victim email from fake or compromised email accounts (a“spear phishing” attack). Agari examined thousands of BEC attacks during Q4 2022. Agari counts BEC as
any response-based spear phishing attack that involves the impersonation of a trusted party (a company
executive, vendor, etc.) to trick a victim into making a financial transaction or sending sensitive data.
Agari protects organizations against phishing, BEC scams, and other advanced email threats.
Fortra found that the average amount requested in wire transfer BEC attacks in 4Q 2022 was $132,559, up
41 percent from the Q3 average of $93,881. The volume of wire transfer BEC attacks in Q4 decreased by 64
percent compared to the prior quarter. This suggests the bad actors behind BEC wire transfer incidents
focused their attention on fewer but more impactful attacks.
During the fourth quarter of 2022, advance fee fraud scams surpassed gift card requests as the mostpopular cash out method, comprising 39 percent of the total compared to just 31 percent of attackers
requesting gift cards as payment. Payroll diversion remained a popular attack type, making up 12 percentof our engagements. Extortion attacks, which included threats of imprisonment and publicembarrassment, made up 7 percent of the attacks we monitored. Wire transfer attacks made up less than 1
percent of the total. A variety of miscellaneous cash out methods accounted for the balance.

6

Phishing Activity Trends Report
4th Quarter 2022
www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 4th Quarter 2022
Amazon was the overwhelming favorite card type for scammers, with 60 percent requesting Amazon giftcards as payment. Apple’s gift card offerings were the second most popular, with 9 percent requesting
iTunes and 9 percent requesting Apple Store cards. Requests for liquid cards, such as American Express,Visa, and Vanilla made up 11.4 percent of gift card requests.

BEC CASH-OUT METHODS, 4Q2022
Other
11%

Extortion
6%

Gift Card
31%

Wire
Transfer1%
Payroll
Diversion
12%

Advance Fee
Fraud
39%
Fortra found that 89 percent of BEC attacks in Q4 2022 were launched using a free webmail domain, up
from 84% in Q3. The remaining 11 percent of BEC attacks in Q4 utilized maliciously registered domains
and compromised email accounts. John Wilson, Senior Fellow, Threat Research at Fortra notes that"Google was the technology provider of choice for BEC scammers in Q4 2022, with 68 percent of freewebmail accounts hosted at Gmail and 27 percent of maliciously registered BEC domains using Google as
their registrar."
Microsoft’s webmail properties powered 22% of webmail based BEC attacks in Q4. Verizon Media, which
includes Yahoo and AOL, accounted for just 4% of the free webmail accounts used for BEC in Q4 2022.

Email-based Threats, 4th Quarter 2022
APWG member PhishLabs by HelpSystems analyzes malicious emails reported by corporate users. JohnWilson, Senior Fellow, Threat Research at Fortra observed: "For the fourth consecutive quarter, the shareof response-based email threats targeting enterprise users increased, with a corresponding decrease incredential theft attacks."
7

Phishing Activity Trends Report
4th Quarter 2022
www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 4th Quarter 2022
"Physical threats, which comprised just 0.3 percent of the social media threats we saw one year ago, madeup 1.02 percent of Q4 2022 social media threats," noted John Wilson.

APWG Phishing Activity Trends Report Contributors

Illumintel provides intelligence, analysis,
Agari by Fortra protects organizations
against phishing, business email
compromise (BEC) scams, and otheradvanced email threats.

due diligence, and public policy advisingin the areas of cybersecurity and Internetbased commerce.

OpSec Security offers world-class brandprotection solutions.

PhishLabs by Fortra provides managed
threat intelligence and mitigation
services that protect brands, customers,
and the enterprise from digital risks.

The APWG Phishing Activity Trends Report is published by the APWG. For further information about theAPWG, please contact APWG Deputy Secretary General Foy Shiver (foy@apwg.org, +1.404.434.728). For
media inquiries related to the company-content of this report, please contact APWG Secretary GeneralPeter Cassidy (pcassidy@apwg.org, +1.617.669.1123); Stefanie Wood Ellis of OpSec Security(sellis@opsecsecurityonline.com); Rachel Woodford of Fortra (Agari and PhishLabs)(Rachel.Woodford@fortra.com). Analysis and editing by Greg Aaron, Illumintel Inc.,
www.illumintel.com

8Phishing Activity Trends Report
4th Quarter 2022
www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 4th Quarter 2022
About the APWG
Founded in 2003, the Anti-Phishing Working Group (APWG) is a not-for-profit industry association focusedon eliminating the identity theft and frauds that result from the growing problem of phishing, crimeware,and e-mail spoofing. Membership is open to financial institutions, online retailers, ISPs, solutions providers,
the law enforcement community, government agencies, multilateral treaty organizations, and NGOs. There
are more than 2,200 enterprises worldwide participating in the APWG.
Operationally, the APWG conducts its core missions through: APWG, a US-based 501(c)6 organization;
the APWG.EU, the institution’s European chapter established in Barcelona in 2013 as a non-profit researchfoundation incorporated in Spain and managed by an independent board; the STOP. THINK. CONNECT.
Messaging Convention, Inc., a US-based non-profit 501(c)3 corporation; and the APWG’s applied research
secretariat <http://www.ecrimeresearch.org>.
APWG’s directors, managers and research fellows advise: national governments; global governance bodies
such as the Commonwealth Parliamentary Association, Organisation for Economic Co-operation andDevelopment, International Telecommunications Union and ICANN; hemispheric and global trade groups;
and multilateral treaty organizations such as
the European Commission, the G8 HighTechnology Crime Subgroup, Council of Europe’s
Convention on Cybercrime, United Nations Office of Drugs and Crime, Organization for Security andCooperation in Europe, Europol EC3 and the Organization of American States. APWG is a founding
member of the steering group of the Commonwealth Cybercrime Initiative at the Commonwealth ofNations.
APWG‘s clearinghouses for cybercrime-related machine event data sendmore than two billion data elements per month outbound to APWG’smembers to inform security applications, forensic routines and research
programs, helping to protection millions of software clients and devices worldwide. APWG Engineeringcontinues to work with data correspondents worldwide to develop new data resources.
APWG‘s STOP. THINK. CONNECT. cybersecurity awareness campaign has
officially engaged campaign curators from 27 nations, 14 of which are deployedby cabinet-level ministries, government CERTs and national-scope NGOs.
The annual APWG Symposium on Electronic Crime Research, proceedings of which are
published by the IEEE, attracts scores of papers from leading scientific investigators
worldwide. The conference, founded in 2006 by APWG, is the only peer-reviewed
conference dedicated exclusively to cybercrime studies.
9

Phishing Activity Trends Report
4th Quarter 2022
www.apwg.org • info@apwg.org