PHISHING ACTIVITY TRENDS REPORTth4 Quarter
2023

Unifying theGlobal Response
To Cybercrime
Table of Contents
Statistical Highlights for 2nd Quarter 2017

3Phishing E-mail Reports and Phishing Site Trends

4Brand-Domain Pairs Measurement

5

Brands & Legitimate Entities Hijacked byE-mail Phishing Attacks

6

Use of Domain Names for Phishing

7-9

Phishing and Identity Theft in Brazil

10-11

Most Targeted Industry Sectors

12

APWG Phishing Trends Report Contributors

13Activity October-December 2023

Published 13 February 2024

Phishing Activity Trends Report, 4th Quarter 2023

Phishing Report Scope
The APWG Phishing Activity Trends Report analyzes
phishing a�acks and other identity the� techniques, asreported to the APWG by its member companies, its
Global Research Partners, through the organization’s
website at h�p://www.apwg.org, and by e-mailsubmissions to reportphishing@antiphishing.org. APWG
measures the evolution, proliferation, and propagation ofidentity the� methods by drawing from the research ofour member companies and industry experts.

2023 Was Worst Year for
Phishing on Record

Phishing Defined
Phishing is a crime employing both social engineering andtechnical subterfuge to steal consumers’ personal identity
data and financial account credentials. Social engineering
schemes prey on unwary victims by fooling them into
believing they are dealing with a trusted, legitimate
party, such as by using deceptive email addresses andemail messages. These are designed to lead consumers tocounterfeit Web sites that trick recipients into divulging
financial data such as usernames and passwords.
Technical subterfuge schemes plant malware onto
computers to steal credentials directly, o�en using
systems that intercept consumers’ account usernames
and passwords or misdirect consumers to counterfeit
Web sites.

Even after a dramatic decrease in thesecond quarter, phishing rose late in theyear, and the APWG observed 1,077,501
phishing attacks in the fourth quarter of 2023
Phishing Activity Trends Summary••

Table of Contents
Statistical Highlights

3

Most-Targeted Industry Sectors

5

Business Email Compromise

6•Free Webmail services used in BEC attacks 82Registrars sponsoring BEC attack domains

8

APWG Phishing Trends Report Contributors

9About the APWG

9Phishing Activity Trends Report4th Quarter 2023
www.apwg.org • info@apwg.org•The APWG observed
1,077,501 phishing a�acks inthe fourth quarter of 2023.
APWG observed almost fivemillion phishing a�acks in2023, the worst year forphishing on record. [pp. 3-4]
A�acks against social media
platforms exploded in late2023, and were 42.8 percent of
all phishing a�acks. [p. 5]
Phishing using phone calls —also known as voice phishingor “vishing” — is increasing
every quarter. [pp. 5-6]
The number of wire transfer
BEC a�acks in Q4 increasedby 24% compared to the priorquarter. While the number ofthese a�acks was up, theaverage dollar amount pera�empt went down, to$56,195. [p. 6]

Phishing Activity Trends Report, 4th Quarter 2023
Statistical Highlights for the 4th Quarter 2023
APWG’s contributing members study the ever-evolving nature and techniques of cybercrime. APWG has
two sources of phishing data: phishing emails reported to it by APWG members and by members of thepublic, and phishing URLs reported by APWG members into the APWG eCrime eXchange.

The APWG tracks:•Unique phishing sites.This is a primary measure of reported phishing across the globe. This isdetermined by the unique bases of phishing URLs found in phishing emails reported to APWG’srepository. (A single phishing site may be advertised as thousands of customized URLs, allleading to basically the same destination.) Thus APWG measures reported phishing sites, which isa more relevant metric than URLs. A synonym for sites is a�acks.

•Unique phishing e-mails subjects.This counts email lures that have different email subject lines.
Some phishing campaigns may use the same subject line but advertise different phishing sites.
This metric is a general measure of the variety of phishing a�acks, and can be a rough proxy forthe amount of phishing taking place.

•The APWG also counts the number of brands attacked by examining the phishing reports
submi�ed into the APWG eCrime Exchange, and normalizing the spellings of brand names.
OctoberNovember

DecemberNumber of unique phishing Web sites (a�acks) detected356,538

350,776

370,187

Unique phishing email campaigns

22,75024,621

20,642

477

442

420

Number of brands targeted by phishing campaigns

The APWG observed almost five million phishing a�acks over the course of 2023 — 4,987,809 a�acks inall. This made 2023 the worst year for phishing on record, ecliping the 4.7 million a�acks seen in 2022.
In the fourth quarter of 2023, APWG observed 1,077,501 phishing a�acks. This was up slightly from the999,956 seen in Q3, but down from the 1,286,208 seen in Q2, and far below the 1,624,144 a�acks seen in Q1
2023, which was the record high quarter in APWG’s historical observations.
Phishing a�acks fell in the second quarter of 2023 in part due to the shut-down of the Freenom freedomain name program. Freenom offered free domain name registrations in five repurposed country top3

Phishing Activity Trends Report
4th Quarter 2023
www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 4th Quarter 2023
level domains (.TK, .ML, .GA, .CF, and .GQ), and this free service was used extensively by phishers formany years. In past years Freenom domains had been used for 14 percent of all phishing a�acksworldwide, and Freenom was responsible for 60 percent of the phishing domains reported in all ccTLDs
in November 2022. Freenom stopped offering free registrations in January 2023, and phishing in its
ccTLDs died out as phishers used up their free domain inventories in mid-2023.1 In February 2024,
Freenom announced its complete exit from the domain name business, and that it had se�led a lawsuitbrought by Meta, which alleged that Freenom had ignored abuse complaints about phishing websites
while monetizing traffic to those abusive domains.2A�er the notable decrease in Q2 2023, phishing levels began creeping up again, and reached the levels
observed in early 2022:

Phishing Attacks, 2021-2023
700,000
600,000
500,000
400,000
300,000
200,000
100,000

Ja
n21
M
ar-2
1
M
ay-2
1
Ju
l-2
1
Se
p21
No
v21
Ja
n22
M
ar-2
2
M
ay-2
2
Ju
l-2
2
Se
p22
No
v22
Ja
n23
M
ar-2
3
M
ay-2
3
Ju
l-2
3
Se
p23
No
v23

0

In Q4 2023, the number of unique email subjects (campaigns) received by the APWG dropped slightly
from the previous quarter. The number of total email reports that APWG received was flat between Q3and Q4.

1

For an in-depth look at the Freenom decrease, see “Phishing Landscape 2022” by Interisle Consulting and APWG
members Greg Aaron and David Piscitello: h�ps://www.interisle.net/PhishingLandscape2023.pdf
2h�ps://www.freenom.com/en/freenom_pressstatement_02122024_v0100.pdf

4Phishing Activity Trends Report
4th Quarter 2023
www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 4th Quarter 2023
Most-Targeted Industry Sectors – 4th Quarter 2023
In the fourth quarter of 2023, APWG founding member OpSec Security found that phishing a�acks
against social media platforms comprised 42.8 percent of all phishing a�acks, exploding from 18.9 percent
of all a�acks in Q3. Phishing against the Financial Institution segment fell, from 24.9 percent of all a�acks
in Q3 to 14 percent in Q4. A�acks against online payment services were another 4 percent of all a�acks.
“Continuing a trend we’ve previously observed, OpSec is tracking a strong increase in phone-based fraud, orvoice phishing,” said Ma� Harris, Senior Product Manager, Fraud at OpSec. “Vishing incidents increased morethan 16 percent over Q3, and represented a nearly 260 percent increase over the Q4 2022 volume.”
OpSec Security offers world-class brand protection solutions.

MOST-TARGETED INDUSTRIES, 4Q 2023
SAAS/ Webmail
15%

Financial
Institution
14%
eCommerce /Retail6%
Logistics /Shipping
5%
Payment
4%
Telecom
Crypto 3%
1%

SocialMedia
43%

5Phishing Activity Trends Report
4th Quarter 2023
www.apwg.org • info@apwg.org

Other9%

Phishing Activity Trends Report, 4th Quarter 2023
Business e-Mail Compromise (BEC), 4th Quarter 2023
APWG member Fortra tracks the identity the� technique known as “business e-mail compromise” orBEC, which was responsible for $51 billion dollars in losses between October 2013 and December 2022
according to the FBI’s Internet Crime Complaint Center (IC3). In a BEC a�ack, a threat actor impersonates
an employee, vendor, or other trusted party in an email communication and a�empts to trick anemployee into sending money, privileged information, or some other asset. Fortra examined thousands ofBEC a�acks a�empted during Q4 2023. Fortra protects organizations against phishing, BEC scams, andother advanced email threats.
Fortra found that when criminals asked victims to send money by wire transfer, the average amountrequested in Q4 2023 was $56,195, down 64 percent from Q3’s average of $157,422. The number of wiretransfer BEC a�acks in Q4 increased by 24 percent compared to the prior quarter. This suggests bad actors
behind BEC wire transfer conducted more a�acks but requested smaller amounts of money in each a�ack.
During the fourth quarter of 2023, gi� card scams were the most popular scam type, and were 37.6
percent of all scams. At number two were advance fee fraud scams, at 30.6 percent. Payroll diversion
remained a popular a�ack type, making up 9.2 percent of Forta’s engagements.
Hybrid vishing is phishing in which the a�acker uses both email and telephone to communicate with thevictim. Fortra rarely saw hybrid vishing before 2023, but these made up 6.1 percent of the a�acks Fortra
recorded in the fourth quarter of 2023.
“The hybrid vishing a�acks we track typically begin with an email, which tells the recipient that he or she
has been charged for a product or service,” said John Wilson, Senior Fellow, Threat Research at Fortra.
“The messages instruct the recipient to call a phone number if they wish to cancel their order and obtain arefund. Geek Squad was the most common brand used as a lure in these a�acks, accounting for 32.2
percent of the Q4 2023 a�acks. This was followed by Norton/LifeLock with 30.4 percent, McAfee at 20
percent, and PayPal with 11.3 percent.”

6Phishing Activity Trends Report
4th Quarter 2023www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 4th Quarter 2023

Above: an email lure used in a hybrid phishing a�ackFortra found that 68 percent of BEC a�acks in Q4 2023 were launched using a free webmail domain, adecrease from the 72 percent observed in Q3. The remaining 32 percent of BEC a�acks utilized a
combination of maliciously registered domains and compromised email accounts.

7

Phishing Activity Trends Report
4th Quarter 2023
www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 4th Quarter 2023

FREE WEBMAIL PROVIDERS USEDIN BEC ATTACKS (Q4 2023)
Other7%
Apple20%
Google52%

Microsoft21%

Google was the most popular free webmail provider for BEC scammers, accounting for 52 percent of thefree webmail accounts used in Q4 2023 BEC scams. This is a significant drop from Google’s 83 percent
share Fortra observed in Q3. Microso�’s webmail properties (e.g. Outlook and Hotmail) powered 21
percent of webmail-based BEC a�acks in Q4, followed by Apple’s webmail domains (e.g. icloud.com;me.com, mac.com) at 20 percent.

REGISTRARS USED TO REGISTER BEC
ATTACK DOMAINS (Q4 2023)
NameCheap
42%

Hostinger
4%
NameSilo
4%
1&1 IONOS
6%

Squarespace
20%

8Phishing Activity Trends Report
4th Quarter 2023
www.apwg.org • info@apwg.org

Other
24%

Phishing Activity Trends Report, 4th Quarter 2023
APWG Phishing Activity Trends Report Contributors

Forta's mission is to helporganizations increase security
maturity while decreasing
operational burden. Forta's brands
include PhishLabs and Agari.
www.forta.com

Illumintel provides intelligence,analysis, due diligence, and public
policy advising in the areas ofcybersecurity and Internet-basedcommerce.

OpSec Security is the leading
provider of integrated online
protection and on-productauthentication solutions for brands
and governments.
www.opsecsecurity.com

www.illumintel.com

The APWG Phishing Activity Trends Report is published by and © the APWG. For info about the APWG,
please contact APWG Deputy Secretary General Foy Shiver (foy@apwg.org, +1.404.434.728). For media
inquiries related to company-provided content in this report, please contact: APWG Secretary GeneralPeter Cassidy (pcassidy@apwg.org, +1.617.669.1123); Stefanie Wood Ellis of OpSec Security(sellis@opsecsecurityonline.com); Rachel Woodford of Fortra (Agari and PhishLabs)(Rachel.Woodford@fortra.com). Analysis and editing by Greg Aaron, Illumintel Inc., illumintel.com

About the APWG
Founded in 2003, the Anti-Phishing Working Group (APWG) is a not-for-profit industry association focusedon eliminating the identity the� and frauds that result from the growing problem of phishing, crimeware,and e-mail spoofing. Membership is open to financial institutions, online retailers, ISPs, solutions providers,
the law enforcement community, government agencies, multilateral treaty organizations, and NGOs. There
are more than 2,200 enterprises worldwide participating in the APWG.
Operationally, the APWG conducts its core missions through: APWG, a US-based 501(c)6 organization;
the APWG.EU, the institution’s European chapter established in Barcelona in 2013 as a non-profit researchfoundation incorporated in Spain and managed by an independent board; the STOP. THINK. CONNECT.
Messaging Convention, Inc., a US-based non-profit 501(c)3 corporation; and the APWG’s applied research
secretariat <h�p://www.ecrimeresearch.org>.

9Phishing Activity Trends Report
4th Quarter 2023
www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 4th Quarter 2023
APWG’s directors, managers and research fellows advise: national governments; global governance bodies
such as the Commonwealth Parliamentary Association, Organisation for Economic Co-operation andDevelopment, International Telecommunications Union and ICANN; hemispheric and global trade groups;
and multilateral treaty organizations suchas the European Commission, the G8 HighTechnology Crime Subgroup, Council ofEurope’s Convention onCybercrime, United Nations Office of Drugs and Crime, Organization for Security and Cooperation inEurope, Europol EC3 and the Organization of American States. APWG is a founding member of the steeringgroup of the Commonwealth Cybercrime Initiative at the Commonwealth of Nations.
APWG‘s clearinghouses for cybercrime-related machine event data sends
more than four billion data elements per month outbound to APWG’smembers to inform security applications, forensic routines and research
programs, helping to protection millions of so�ware clients and devices worldwide. APWG Engineeringcontinues to work with data correspondents worldwide to develop new data resources.
APWG‘s STOP. THINK. CONNECT. cybersecurity awareness campaign
has officially engaged campaign curators from 26 nations, 13 of which
are deployed by cabinet-level ministries, government CERTs and national-scope NGOs.
The annual APWG Symposium on Electronic Crime Research,
proceedings of which are published by the IEEE, a�racts scoresof papers from leading scientific investigators worldwide. The

2024

conference, founded in 2006 by APWG, is the only peer-reviewed conference dedicated exclusively tocybercrime studies.

10Phishing Activity Trends Report
4th Quarter 2023
www.apwg.org • info@apwg.org