PHISHING ACTIVITY TRENDS REPORT

3 Quarter2023
rdUnifying theGlobal Response
To Cybercrime

Table of Contents
Statistical Highlights for 2nd Quarter 2017

3Phishing E-mail Reports and Phishing Site Trends

4

Brand-Domain Pairs Measurement

5

Brands & Legitimate Entities Hijacked byE-mail Phishing Attacks

6

Use of Domain Names for Phishing

7-9

Phishing and Identity Theft in Brazil

10-11

Most Targeted Industry Sectors

12

APWG Phishing Trends Report Contributors

13Activity July-September 2023

Published 13 November 2023

Phishing Activity Trends Report, 3rd Quarter 2023

Phishing Report Scope
The APWG Phishing Activity Trends Report analyzes
phishing attacks and other identity theft techniques, asreported to the APWG by its member companies, its
Global Research Partners, through the organization’s
website at http://www.apwg.org, and by e-mailsubmissions to reportphishing@antiphishing.org. APWG
measures the evolution, proliferation, and propagation ofidentity theft methods by drawing from the research ofour member companies and industry experts.

Phishing Drops from RecordHigh; Returns to 2022 Levels

Phishing Defined
Phishing is a crime employing both social engineering andtechnical subterfuge to steal consumers’ personal identity
data and financial account credentials. Social engineering
schemes prey on unwary victims by fooling them into
believing they are dealing with a trusted, legitimate
party, such as by using deceptive email addresses andemail messages. These are designed to lead consumers tocounterfeit Web sites that trick recipients into divulging
financial data such as usernames and passwords.
Technical subterfuge schemes plant malware onto
computers to steal credentials directly, often using
systems that intercept consumers’ account usernames
and passwords or misdirect consumers to counterfeit
Web sites.

Table of Contents

In Q3 2023, unique email subject lines (campaigns)
received by the APWG stabilized around 32,000 month,after averaging 40,000+ per month in Q1 2023. Total email
reports APWG received also dipped between Q2 and Q3

Phishing Activity Trends Summary••

Statistical Highlights

3

Most-Targeted Industry Sectors

4

Business Email Compromise

5

APWG Phishing Trends Report Contributors

8

About the APWG8••2Phishing Activity Trends Report
3rd Quarter 2023www.apwg.org • info@apwg.org

In the third quarter of 2023, theAPWG observed 999,956 phishingattacks. This represented a 37.5
percent drop from the first quarterof 2023. Phishing fell back to thelevels seen in late 2021. [pp. 3-4]
The number of voice-mail phishing,or vishing, as a sub-category ofphishing swelled 40 percent from Q1
2023 through Q3 2023. [pp. 5-6]
The average amount requested inwire transfer BEC attacks in Q3 2023
was $164,645, down 44 percent fromthe Q2 average of $293,359.
However, the volume of wiretransfer BEC attacks in Q3 increasedby 55 percent. [pp. 5-6]
The financial sector continued to be
the most-attacked sector, with 24.9
percent of all phishing attacks.
Attacks against social media
companies were second, at 18.9
percent. [pp. 4- 5]!

Phishing Activity Trends Report, 3rd Quarter 2023
Statistical Highlights for the 3rd Quarter 2023
APWG’s contributing members study the ever-evolving nature and techniques of cybercrime. APWG has
two sources of phishing data: phishing emails reported to it by APWG members and by members of thepublic, and phishing URLs reported by APWG members into the APWG eCrime eXchange.
The APWG tracks:•Unique phishing sites. This is a primary measure of reported phishing across the globe. This isdetermined by the unique bases of phishing URLs found in phishing emails reported to APWG’srepository. (A single phishing site may be advertised as thousands of customized URLs, allleading to basically the same destination.) Thus APWG measures reported phishing sites, which isa more relevant metric than URLs. A synonym for sites is attacks.

•Unique phishing e-mails subjects. This counts email lures that have different email subject lines.
Some phishing campaigns may use the same subject line but advertise different phishing sites.
This metric is a general measure of the variety of phishing attacks, and can be a rough proxy forthe amount of phishing taking place.

•The APWG also counts the number of brands attacked by examining the phishing reports
submitted into the APWG eCrime eXchange, and normalizing the spellings of brand names.
JulyAugustSept

Number of unique phishing Web sites (attacks) detected327,294

331,962

340,700

Unique phishing email campaigns

29,11032,162

32,740

477

499

508

Number of brands targeted by phishing campaigns

In the third quarter of 2023, APWG observed 999,956 phishing attacks. This was down from the 1,286,208
seen in Q2, and the 1,624,144 attacks seen in 1Q 2023, which was the record high quarter in our historicalobservations. The 306,847 attacks reported to APWG in June 2023 was the smallest monthly total sinceNovember 2021.
Put another way, the APWG observed a 37.5 percent drop in phishing between the first quarter and thethird quarter of 2023. Looking at the last two years, the new data confirmed a trend: phishing fell back tothe levels seen in late 2021:

3Phishing Activity Trends Report
3rd Quarter 2023
www.apwg.org • info@apwg.org!

Phishing Activity Trends Report, 3rd Quarter 2023

Phishing Attacks, Q4 2021 thru Q3 2023
700,000
600,000
500,000
400,000
300,000
200,000
100,000

Sep-23Aug-23

Jul-23Jun-23May-23Apr-23Mar-23

Feb-23Jan-23

Dec-22

Nov-22Oct-22

Sep-22Aug-22

Jul-22Jun-22

May-22

Apr-22Mar-22

Feb-22

Jan-22

Dec-21

Nov-21

Oct-21

0

In Q3 2023, the number of unique email subject lines (campaigns) received by the APWG also stabilizedaround 32,000 month, after averaging more than than 40,000 per month in Q1 2023. The number of total
email reports that APWG received also dipped between Q2 and Q3.
The overall phishing trend that the APWG data shows was also seen by other observers. The Cybercrime
Information Center (https://www.cybercrimeinfocenter.org/), which collects phishing data from several
sources. The Cybercrime Information Center saw phishing peak in late 2022 into January 2023, and thendrop back to levels seen in mid-2022. APWG contributor OpSec Security independently noted a fraudvolume decrease from Q1 to Q2 2023, and then stabilizing across Q3 2023 (see below).

Most-Targeted Industry Sectors – 3rd Quarter 2023
In the third quarter of 2023, APWG founding member OpSec Security found that phishing attacks against
the financial sector (which includes banks) remained the largest set of attacks, accounting for 24.9 percent
of all phishing – up from 23.5 percent in Q2 2023. Attacks against online payment services were another6.6 percent of all attacks.

4

Phishing Activity Trends Report
3rd Quarter 2023
www.apwg.org • info@apwg.org!

Phishing Activity Trends Report, 3rd Quarter 2023
Attacks against social media companies remian the second-largest category. Social media attacks were
18.9 percent of all attacks in 3Q 2023, after being 22.3 percent in Q2 2023.
Matthew Harris, Senior Product Manager, Fraud at OpSec Security, noted: “Our measurements show that
there was a fraud volume decrease from Q1 to Q2 2023, and that the volumes in Q2 and Q3 were nearly
identical.”
Harris added: “We continue to track a strong increase in mobile phone-based fraud, or voice phishing.
Vishing detection volumes swelled 40 percent from Q1 2023 through Q3 2023.”

MOST-TARGETED INDUSTRIES, 3Q 2023
Social Media,
18.9%

FinancialInstitution, 24.9%

Travel, 1.4%
Gaming, 1.4%
Cryptocurrency,
1.8%

SAAS / Webmail,16.4%

eCommerce /Retail, 6.3%
Telecom, 6.5%
Payment, 6.6%

Other, 9.0%
Logistics /Shipping, 6.8%

OpSec Security offers world-class brand protection solutions.

Business e-Mail Compromise (BEC), 2nd Quarter 2023

APWG member Fortra tracks the identity theft technique known as “business e-mail compromise” orBEC, which was responsible for $50.8 billion dollars in losses between October 2013 and December 2022,
according to the FBI’s Internet Crime Complaint Center (IC3). In a BEC attack, a threat actor impersonates
5

Phishing Activity Trends Report
3rd Quarter 2023
www.apwg.org • info@apwg.org!

Phishing Activity Trends Report, 3rd Quarter 2023
an employee, vendor, or other trusted party in an email communication and attempts to trick anemployee into sending money, privileged information, or some other asset. Fortra examined thousands ofBEC attacks attempted during Q2 2023.
Fortra found that the average amount requested in wire transfer BEC attacks in Q3 2023 was $164,645,
down 44 percent from the Q2 average of $293,359. However, the volume of wire transfer BEC attacks inQ3 increased by 55 percent compared to the prior quarter.
“For the first time ever, hybrid vishing attacks were the most common type of email scam that weobserved,” said John Wilson, Senior Fellow, Threat Research at Fortra. “These made up 44 percent of theresponse-based email scams we observed in Q3 2023. Advanced fee fraud, which is traditionally the mostcommon email scam we see, came in second with a 22 percent share. These were followed by gift card
scams at 19 percent, and payroll diversion attempts at 4 precent.”
Wilson noted: “The hybrid vishing attacks we track typically begin as an email indicating the recipient
has been charged for a product or service. The messages instruct the recipient to call a phone number ifthey wish to cancel their order and obtain a refund. Fortra identified 250 unique phone numbers
impersonating 15 different brands in Q3 hybrid vishing attacks.”
Fortra found that 79 percent of BEC attacks launched in Q3 2023 utilized a free webmail domain, adecrease from the 87 percent share observed in the previous quarter.

FREE WEBMAIL PROVIDERS USED IN
BEC ATTACKS, Q3 2023

Microsoft,
6.7%

Google,84.0%

6Other, 5.2%
mail.com,
Verizon1.6% ,virgilio.it,
1.6%
1.0%

Phishing Activity Trends Report
3rd Quarter 2023
www.apwg.org • info@apwg.org!

Phishing Activity Trends Report, 3rd Quarter 2023
The remaining 21 percent of BEC attacks in Q3 2023 utilized maliciously registered domains andcompromised email accounts. Google was once again the overwhelmingly most popular webmail
provider among BEC scammers, with Gmail addresses making up 84 percent of the scammer webmail
accounts that Forta observed in Q3.
When BEC scammers requested to be paid in gift cards, they usually requested Amazon and Apple Storecards, with iTunes cards a distant third:

GIFT CARDS REQUESTED IN BEC
ATTACKS, Q3 2023
Amazon,35.0%

Visa, 5.0%
Steam, 5.0%
Google Play,
5.0%
Other, 10.0%

Apple Store,32.5%

iTunes, 7.5%

Fortra protects organizations against phishing, BEC scams, and other advanced email threats.

7Phishing Activity Trends Report
3rd Quarter 2023
www.apwg.org • info@apwg.org!

Phishing Activity Trends Report, 3rd Quarter 2023
APWG Phishing Activity Trends Report Contributors

Forta's mission is to helporganizations increase security
maturity while decreasing
operational burden. Forta's brandsinclude PhishLabs and Agari.
www.forta.com

Illumintel provides intelligence,analysis, due diligence, and public
policy advising in the areas ofcybersecurity and Internet-based
commerce.
www.illumintel.com

OpSec Security is the leading
provider of integrated online
protection and on-productauthentication solutions for brands
and governments.
www.opsecsecurity.com

The APWG Phishing Activity Trends Report is published by and © the APWG. For info about the APWG,
please contact APWG Deputy Secretary General Foy Shiver (foy@apwg.org, +1.404.434.728). For media
inquiries related to company-provided content in this report, please contact: APWG Secretary GeneralPeter Cassidy (pcassidy@apwg.org, +1.617.669.1123); Stefanie Wood Ellis of OpSec Security(sellis@opsecsecurityonline.com); Rachel Woodford of Fortra (Agari and PhishLabs)(Rachel.Woodford@fortra.com). Analysis and editing by Greg Aaron, Illumintel Inc., illumintel.com

About the APWG
Founded in 2003, the Anti-Phishing Working Group (APWG) is a not-for-profit industry association focusedon eliminating the identity theft and frauds that result from the growing problem of phishing, crimeware,and e-mail spoofing. Membership is open to financial institutions, online retailers, ISPs, solutions providers,
the law enforcement community, government agencies, multilateral treaty organizations, and NGOs. There
are more than 2,200 enterprises worldwide participating in the APWG.
Operationally, the APWG conducts its core missions through: APWG, a US-based 501(c)6 organization;
the APWG.EU, the institution’s European chapter established in Barcelona in 2013 as a non-profit researchfoundation incorporated in Spain and managed by an independent board; the STOP. THINK. CONNECT.
Messaging Convention, Inc., a US-based non-profit 501(c)3 corporation; and the APWG’s applied research
secretariat <http://www.ecrimeresearch.org>.

8

Phishing Activity Trends Report
3rd Quarter 2023
www.apwg.org • info@apwg.org!

Phishing Activity Trends Report, 3rd Quarter 2023
APWG’s directors, managers and research fellows advise: national governments; global governance bodies
such as the Commonwealth Parliamentary Association, Organisation for Economic Co-operation andDevelopment, International Telecommunications Union and ICANN; hemispheric and global trade groups;
and multilateral treaty organizations such as
the European Commission, the G8 High Technology
Crime Subgroup, Council of Europe’s Convention onCybercrime, United Nations Office of Drugs and Crime, Organization for Security and Cooperation inEurope, Europol EC3 and the Organization of American States. APWG is a founding member of the steeringgroup of the Commonwealth Cybercrime Initiative at the Commonwealth of Nations.
APWG‘s clearinghouses for cybercrime-related machine event data sends
more than two billion data elements per month outbound to APWG’smembers to inform security applications, forensic routines and research
programs, helping to protection millions of software clients and devices worldwide. APWG Engineeringcontinues to work with data correspondents worldwide to develop new data resources.
APWG‘s STOP. THINK. CONNECT. cybersecurity awareness campaign has
officially engaged campaign curators from 26 nations, 13 of which aredeployed by cabinet-level ministries, government CERTs and national-scope NGOs.
The annual APWG Symposium on Electronic Crime Research,
proceedings of which are published by the IEEE, attracts scoresof papers from leading scientific investigators worldwide. The2024

conference, founded in 2006 by APWG, is the only peer-reviewed conference dedicated exclusively tocybercrime studies.

9

Phishing Activity Trends Report
3rd Quarter 2023
www.apwg.org • info@apwg.org!