PHISHING ACTIVITY TRENDS REPORT

2 Quarter
2022
ndUnifying theGlob a l Re sp onse
T o Cyb er cr ime

Table of Contents
Statistical Highlights for 2nd Quarter 20173

Phishing E-mail Reports and Phishing Site Trends

4

Brand-Domain Pairs Measurement

5Brands & Legitimate Entities Hijacked byE-mail Phishing Attacks

6

Use of Domain Names for Phishing

7-9

Phishing and Identity Theft in Brazil

10-11

Most Targeted Industry Sectors

12

APWG Phishing Trends Report Contributors

13Activity April-June 2022

Published 20 September 2022

Phishing Activity Trends Report, 2nd Quarter 2022

Jun-22

May-22

Apr-22Mar-22

Feb-22

Jan-22

Dec-21

Nov-21

Oct-21Phishing is a crime employing both social engineering andtechnical subterfuge to steal consumers’ personal identity
data and financial account credentials. Social engineering
schemes prey on unwary victims by fooling them into
believing they are dealing with a trusted, legitimate
party, such as by using deceptive email addresses andemail messages. These are designed to lead consumers tocounterfeit Web sites that trick recipients into divulging
financial data such as usernames and passwords.
Technical subterfuge schemes plant malware onto
computers to steal credentials directly, often using
systems that intercept consumers’ account usernames
and passwords or misdirect consumers to counterfeit
Web sites.

450,000
400,000
350,000
300,000
250,000
200,000
150,000
100,000
50,0000

Sep-21Phishing Defined

Phishing Attacks, 3Q20212Q2022

Aug-21The APWG Phishing Activity Trends Report analyzes
phishing attacks and other identity theft techniques, asreported to the APWG by its member companies, its
Global Research Partners, through the organization’s
website at http://www.apwg.org, and by e-mailsubmissions to reportphishing@antiphishing.org. APWG
measures the evolution, proliferation, and propagation ofidentity theft methods by drawing from the research ofour member companies and industry experts.

Phishing Attacks Climb toNew Record High in 2022

Jul-21Phishing Report Scope

Phishing Activity Trends Summary•

In the second quarter of 2022, APWG
observed 1,097,811 total phishing attacks, anew record and the worst quarter forphishing that APWG has ever observed.
[pp. 3-4]

Table of Contents
Statistical Highlights
Most-Targeted Industry Sectors
Ransomware
Business E-mail Compromise (BEC)
Email-Based Threats
APWG Phishing Trends Report Contributors
About the APWG

3568101213•

The average amount requested in wiretransfer BEC attacks in Q2 2022 was$109,467, up from $91,436 in Q1 2022.
[pp. 8-9]•

The healthcare and transportationindustries suffered an increase inransomware attacks. [pp. 6-7]

•Threats on social media continued to rise,with a 47 percent increase from Q1 to Q2
2022. [pp. 11-12]•There has been an increase in mobile phone
based fraud, with smishing and vishingincreasing in Q2 2022. [p. 5]

2Phishing Activity Trends Report
2nd Quarter 2022
www.apwg.org • info@apwg.org

APWG.ORG

Phishing Activity Trends Report, 2nd Quarter 2022
Statistical Highlights for the 1st Quarter 2022
APWG’s contributing members study the ever-evolving nature and techniques of cybercrime. With thisreport, the APWG has refined the methodologies it uses to report phishing. APWG has two sources ofphishing data: phishing emails reported to it by APWG members and by members of the public, andphishing URLs reported by APWG members into the APWG eCrime eXchange.
The APWG tracks:•Unique phishing sites. This is a primary measure of reported phishing across the globe. This isdetermined by the unique bases of phishing URLs found in phishing emails reported to APWG’srepository. (A single phishing site may be advertised as thousands of customized URLs, allleading to basically the same destination.) Thus APWG measures reported phishing sites, which
is a more relevant metric than URLs. A synonym for sites is attacks.

•Unique phishing e-mails subjects. This counts email lures that have different email subject lines.
Some phishing campaigns may use the same subject line but advertise different phishing sites.
This metric is a general measure of the variety of phishing attacks, and can be a rough proxy forthe amount of phishing taking place.

•The APWG also counts the number of brands attacked by examining the phishing reports
submitted into the APWG eCrime Exchange, and normalizing the spellings of brand names.
AprilMayJune

Number of unique phishing Web sites (attacks) detected362,852

353,242

381,717

Unique phishing email subjects

21,54020,33923,550

621

612

637

Number of brands targeted by phishing campaigns

In the first quarter of 2022, APWG observed 1,025,968 total phishing attacks. In the second quarter of2022, APWG observed 1,097,811 total phishing attacks, a new record and the worst quarter for phishingthat APWG has ever observed. The number of phishing attacks reported to APWG has quadrupled since
early 2020, when APWG was observing between 68,000 and 94,000 attacks per month.

3Phishing Activity Trends Report
2nd Quarter 2022www.apwg.org • info@apwg.org

APWG.ORG

Phishing Activity Trends Report, 2nd Quarter 2022

Phishing Attacks, 3Q2021-Q2022
450,000
400,000
350,000
300,000
250,000

200,000
150,000
100,000

50,0000Jul-21 Aug-21 Sep-21 Oct-21 Nov-21 Dec-21 Jan-22 Feb-22 Mar-22 Apr-22 May-22 Jun-22

The number of Unique Subjects grew as more submitted emails had differing subject lines. The number ofbrands attacked each month has remained below the high of 715 observed in September 2021:

Brands Attacked, 3Q2021-2Q2022
80070060050040030020010004Phishing Activity Trends Report
2nd Quarter 2022
www.apwg.org • info@apwg.org

APWG.ORG

Phishing Activity Trends Report, 2nd Quarter 2022
Most-Targeted Industry Sectors – 2nd Quarter 2022
In Q2 2022, APWG founding member OpSec Security found that phishing attacks against the financial
sector, which includes banks, remained the largest set of attacks, accounting for 27.6 percent of allphishing. Attacks against webmail and software-as-a-service (SAAS) providers remained prevalent aswell, while attacks against retail/ecommerce sites fell from 14.6 to 5.6 percent. Phishing against social
media companies rose, from 8.5 percent of all attacks in 4Q2021 to 15.5 percent in 2Q2022. Phishingagainst cryptocurrency targets — such as cryptocurrency exchanges and wallet providers — remained
active, and were more prevalent than attacks against online games, government sites, and telecom
services combined. Overall, OpSec detected a 43 percent increase in phishing compared to Q1 2022.
Matthew Harris, Senior Product Manager, Fraud at Opsec, noted: “Lastly, we're seeing a huge increase inmobile phone-based fraud, with smishing and vishing collectively seeing a nearly 70 percent increase involume as compared to Q1 totals.”“We are still seeing fraud coming in via the typical OTT apps (WhatsApp, WeChat, Facebook Messenger,etc), but the SMS-based fraud is really the kicker here,” Harris said.

MOST-TARGETED INDUSTRIES,
2Q2022
Telecom,
2.6%
Logistics /Shipping,
4.3%
Cryptocurrency,
4.5%

Other, 14.7%

Financial
Institution ,27.6%

eCommerce /Retail, 5.6%
Payment,
6.3%
Social Media ,15.3%

SaaS /Webmail,19.1%

OpSec Security offers world-class brand protection solutions.
5
Phishing Activity Trends Report
2nd Quarter 2022
www.apwg.org • info@apwg.org

APWG.ORG

Phishing Activity Trends Report, 2nd Quarter 2022
Ransomware – 2nd Quarter 2022
APWG member Abnormal Security tracks ransomware: malware that forces a company to pay a ransom tothe perpetrator. The malware may encrypt the victim’s data so that it cannot be used until the criminal
unlocks it, or it makes the data or system otherwise inaccessible. Abnormal Security tracks and stopsransomware delivered via email to its customers, and tracks victims through a combination ofransomware extortion blog monitoring on the dark web and open-source intelligence collection. Thesemethods provide a representative look at the overall ransomware threat landscape and lets the company
make inferences about global ransomware trends.
After spiking in the last quarter of 2021, Abnormal observed a decrease in ransomware volume over the
first and second quarters of 2022. In June 2022, Abnormal observed the smallest number of ransomware
victim companies since January 2021.

Companies Victimized by Ransomware
1000900

Number of Victims

8007006005004003002001000
Q1 2020 Q2 2020 Q3 2020 Q4 2020 Q1 2021 Q2 2021 Q3 2021 Q4 2021 Q1 2022 Q2 2022

The top industries impacted by ransomware in Q2 2022 were manufacturing, business services, retail andwholesale firms, and the healthcare sector, which includes hospitals:

6
Phishing Activity Trends Report
2nd Quarter 2022
www.apwg.org • info@apwg.org

APWG.ORG

Phishing Activity Trends Report, 2nd Quarter 2022

RANSOMWARE VICTIM INDUSTRIES,
2Q2022Energy &NaturalResources
3%
Legal Services
4%

Other
10%
Manufacturing
24%

Education
5%
Government
5%
BusinessServices
12%

Transportation
6%
Finance
6%Construction
7%

Health Care
8%

Retail &Wholesale
10%

Crane Hassold, Director of Threat Intelligence at Abnormal Security, analyzed the ransomware activity
over the quarter. “The Transportation industry saw the largest growth in ransomware victims. Much ofthe increase in ransomware attacks against transportation companies was due to LockBit’s focus on thesector during the quarter. The healthcare industry, which has long been a concerning target ofransomware attacks, also experienced a significant increase in attacks in the second quarter, growing 53
percent compared to the first quarter.”“Almost all global regions saw a net decrease in the number of ransomware victims identified in thoseregions.,” said Hassold. “The one exception was the Asia-Pacific (APAC) region, which saw a 31 percent
increase in ransomware victims in the second quarter. Interestingly, the increase of attacks in the APAC
region wasn’t caused by a spike in activity against companies in a single country. Rather, the number ofransomware victims increased in numerous countries in the region—most notably in Australia, Thailand,
Japan, and Taiwan.”
About 56 percent of victimized companies had less than US$50 million in revenue, down from about 66
7percent in 2021. These smaller companies are generally unable to invest large amounts of money inPhishing Activity Trends Report
2nd Quarter 2022
www.apwg.org • info@apwg.org

APWG.ORG

Phishing Activity Trends Report, 2nd Quarter 2022
cybersecurity, which makes them better opportunistic targets. But almost 13 percent of the victim
corporations had deep pockets, with revenues of more than US$500 million:

RAMSOMWARE CORPORATE VICTIM REVENUE, IN
US DOLLARS, 2Q2022$500 million - $1billion
5%$250 - $500
million7%> $1 billion
8%< $10 million
30%$100 - $250
million11%$50 - $100
million13%$10 - $50
million
26%

Business e-Mail Compromise (BEC), 1st Quarter 2022
APWG member Agari by HelpSystems tracks the identity theft technique known as “business e-mailcompromise” or BEC, which has caused aggregate losses in the billions of dollars, at large and small
companies. In a BEC attack, a scammer impersonates a company employee or other trusted party, and tries
to trick an employee into sending money, usually by sending the victim email from fake or compromised
email accounts (a “spear phishing” attack). Agari examined thousands of BEC attacks attempted during
Q2 2022. Agari counts BEC as any response-based spear phishing attack that involves the impersonationof a trusted party (a company executive, vendor, etc.) to trick a victim into making a financial transaction
or sending sensitive materials. Agari protects organizations against phishing, BEC scams, and otheradvanced email threats.
8Phishing Activity Trends Report
2nd Quarter 2022
www.apwg.org • info@apwg.org

APWG.ORG

Phishing Activity Trends Report, 2nd Quarter 2022
In Q2 2022, gift card requests were the most popular cash-out method used by criminals, making up 39.9
percent of the total, followed by payroll diversion attempts (25.9%), advanced fee fraud (15.5%), and wiretransfers (9.6%). Agari found that the average amount requested in wire transfer BEC attacks in Q2 2022
was $109,467, up from $91,436 in Q1 2022. A variety of miscellaneous cash out methods accounted for theremaining 9.1 percent.
Q2 2022 saw a jump in gift card requests and a slight increase in wire transfer requests compared to theprevious quarter. Google Play was once again the most requested gift card in Q2 2022, accounting for 31.9
percent of all gift card requests. This was followed by Apple’s offerings (Apple Store 14.0% + iTunes 8.7%)
and Amazon (13.1%). Liquid cards not tied to a specific retailer, such as Mastercard, Visa, American
Express, and One Vanilla, made up 17.4 percent of gift card requests.
Agari found that 73 percent of BEC attacks in Q2 2022 were launched using a free webmail address. John
Wilson, Senior Fellow, Threat Research at HelpSystems, noted that "Google was the single largest
technology provider used by BEC criminals, with 72 percent of webmail addresses and 24 percent ofmaliciously registered domains hosted on Google Gmail email platform." Microsoft (Outlook, Hotmail)was next with 8 percent. followed by Virgin Media at 5 percent.

Email-based Threats, 2nd Quarter 2022
APWG member PhishLabs by HelpSystems analyzes malicious emails reported by corporate users.
9Phishing Activity Trends Report
2nd Quarter 2022
www.apwg.org • info@apwg.org

APWG.ORG

Phishing Activity Trends Report, 2nd Quarter 2022
“The industry is quite good at keeping malware out of enterprise user inboxes,” said John Wilson, Senior
Fellow, Threat Research at HelpSystems. “However, that’s not the case for phishing emails that steal
credentials or elicit a response (like BEC). Ninety-five percent of the threats found in enterprise user
inboxes in Q2 were either credential theft or response-based attacks.”

MALWARE DELIVERED TO CORPORATEEMAIL BOXES, 2Q 2022
Bumblebee
3%other7%

Qbot
43%

Emotet47%“Threats on social media continues to rise with a 47 percent increase from Q1 to Q2,” said Wilson.
“Impersonation and fraud are the top two threats, accounting for three out of every four social media
attacks. Malicious actors use social media to reach massive audiences, posing significant risk toenterprises and their brands.”

10Phishing Activity Trends Report
2nd Quarter 2022
www.apwg.org • info@apwg.org

APWG.ORG

Phishing Activity Trends Report, 2nd Quarter 2022

Social Media Threat Type50%
45%40%35%30%
25%
20%
15%
10%
5%0%
Q1 2021

Cyber Threat

Q2 2021

Q3 2021

Data LeakFraud

Q4 2021

Q1 2022Impersonation

Q2 2022

Physical Threat

11
Phishing Activity Trends Report
2nd Quarter 2022
www.apwg.org • info@apwg.org

APWG.ORG

Phishing Activity Trends Report, 2nd Quarter 2022
APWG Phishing Activity Trends Report Contributors

Abnormal Security provides a leading
cloud email security platform to stop
attacks that evade traditional Secure
Email Gateways.

Agari by HelpSystems protects

Axur works to identify and fight theorganizations against phishing,threats in the cyberspace that interfere

business email compromise (BEC)with the interests of companies,

scams, and other advanced email

governments, and individuals.

threats.

Illumintel provides intelligence,analysis, due diligence, and public
policy advising in the areas ofcybersecurity and Internet-based

PhishLabs by HelpSystems provides
OpSec Security offers world-class brandprotection solutions.

commerce.

managed threat intelligence andmitigation services that protect brands,customers, and the enterprise fromdigital risks.

The APWG Phishing Activity Trends Report is published by the APWG. For further information about theAPWG, please contact APWG Deputy Secretary General Foy Shiver (foy@apwg.org, +1.404.434.728). For
media inquiries related to the company-content of this report, please contact APWG Secretary GeneralPeter Cassidy (pcassidy@apwg.org, +1.617.669.1123); Anil Prasad at Abnormal Security(www.abnormalsecurity.com/contact), Stefanie Wood Ellis of OpSec Security(sellis@opsecsecurityonline.com); Rachel Woodford of Agari (Rachel.Woodford@helpsystems.com),
Eduardo Schultze of Axur (eduardo.schultze@axur.com,+55 51 3012-2987); Rachel Woodford ofHelpSystems (Rachel.Woodford@helpsystems.com). Analysis and editing by Greg Aaron, IllumintelInc., www.illumintel.com

12
Phishing Activity Trends Report
2nd Quarter 2022
www.apwg.org • info@apwg.org

APWG.ORG

Phishing Activity Trends Report, 2nd Quarter 2022
About the APWG
Founded in 2003, the Anti-Phishing Working Group (APWG) is a not-for-profit industry association focusedon eliminating the identity theft and frauds that result from the growing problem of phishing, crimeware,and e-mail spoofing. Membership is open to financial institutions, online retailers, ISPs, solutions providers,
the law enforcement community, government agencies, multilateral treaty organizations, and NGOs. There
are more than 2,200 enterprises worldwide participating in the APWG.
Operationally, the APWG conducts its core missions through: APWG, a US-based 501(c)6 organization;
the APWG.EU, the institution’s European chapter established in Barcelona in 2013 as a non-profit researchfoundation incorporated in Spain and managed by an independent board; the STOP. THINK. CONNECT.
Messaging Convention, Inc., a US-based non-profit 501(c)3 corporation; and the APWG’s applied research
secretariat <http://www.ecrimeresearch.org>.
APWG’s directors, managers and research fellows
advise: national governments; global governancebodies such as the Commonwealth Parliamentary
Association, Organisation for Economic Co-operation and Development, International Telecommunications
Union and ICANN; hemispheric and global trade groups; and multilateral treaty organizations such as
the European Commission, the G8 High Technology Crime Subgroup, Council of Europe’s Convention onCybercrime, United Nations Office of Drugs and Crime, Organization for Security and Cooperation inEurope, Europol EC3 and the Organization of American States. APWG is a founding member of the steeringgroup of the Commonwealth Cybercrime Initiative at the Commonwealth of Nations.
APWG‘s clearinghouses for cybercrime-related machine event data sendmore than two billion data elements per month outbound to APWG’smembers to inform security applications, forensic routines and research
programs, helping to protection millions of software clients and devices worldwide. APWG Engineeringcontinues to work with data correspondents worldwide to develop new data resources.
APWG‘s STOP. THINK. CONNECT. cybersecurity awareness campaign has
officially engaged campaign curators from 26 nations, 13 of which are deployed bycabinet-level ministries, government CERTs and national-scope NGOs.
The annual APWG Symposium on Electronic Crime Research, proceedings of which arepublished by the IEEE, attracts scores of papers from leading scientific investigators
worldwide. The conference, founded in 2006 by APWG, is the only peer-reviewed
conference dedicated exclusively to cybercrime studies.
13
Phishing Activity Trends Report
2nd Quarter 2022
www.apwg.org • info@apwg.org

APWG.ORG