PHISHING ACTIVITY TRENDS REPORT

2 Quarter
2023
ndUnifying theGlob a l Re sp onse
T o Cyb er cr ime

Table of Contents
Statistical Highlights for 2nd Quarter 20173

Phishing E-mail Reports and Phishing Site Trends

4

Brand-Domain Pairs Measurement

5Brands & Legitimate Entities Hijacked byE-mail Phishing Attacks

6

Use of Domain Names for Phishing

7-9

Phishing and Identity Theft in Brazil

10-11

Most Targeted Industry Sectors

12

APWG Phishing Trends Report Contributors

13Activity April-June 2023

Published 7 November 2023

Phishing Activity Trends Report, 2nd Quarter 2023

Phishing Report Scope
The APWG Phishing Activity Trends Report analyzes
phishing attacks and other identity theft techniques, asreported to the APWG by its member companies, its
Global Research Partners, through the organization’s
website at http://www.apwg.org, and by e-mailsubmissions to reportphishing@antiphishing.org. APWG
measures the evolution, proliferation, and propagation ofidentity theft methods by drawing from the research ofour member companies and industry experts.

Phishing Remained High in
Q2 2023, but TrendingDownward

Phishing Defined
Phishing is a crime employing both social engineering andtechnical subterfuge to steal consumers’ personal identity
data and financial account credentials. Social engineering
schemes prey on unwary victims by fooling them into
believing they are dealing with a trusted, legitimate
party, such as by using deceptive email addresses andemail messages. These are designed to lead consumers tocounterfeit Web sites that trick recipients into divulging
financial data such as usernames and passwords.
Technical subterfuge schemes plant malware onto
computers to steal credentials directly, often usingsystems that intercept consumers’ account usernames
and passwords or misdirect consumers to counterfeit
Web sites.

Phishing Activity Trends Summary•

Table of Contents
Statistical Highlights

3

Most-Targeted Industry Sectors

4

Business Email Compromise

5

APWG Phishing Trends Report Contributors

7

About the APWG

8

•

•

•

2

Phishing Activity Trends Report
2nd Quarter 2023
www.apwg.org • info@apwg.org

In the second quarter of 2023, the APWG
observed 1,286,208 phishing attacks. This
was the third-highest querterly total that theAPWG has ever recorded. However,phishing trended downward. [pp. 3-4]
The average wire transfer amount requested
in BEC attacks in Q2 2023 was $293,359.
This was up 57 percent from Q1’s average of$187,053. [pp. 5-6]
The financial sector continued to be themost-attacked sector, with 23.5 percent of allphishing attacks. Attacks against online
payment services were another 5.8 percent
of all attacks. [pp. 4- 5]
Voice-mail phishing, or vishing, volumecontinues to rise. [pp. 4-5]

Phishing Activity Trends Report, 2nd Quarter 2023
Statistical Highlights for the 2nd Quarter 2023
APWG’s contributing members study the ever-evolving nature and techniques of cybercrime. APWG has
two sources of phishing data: phishing emails reported to it by APWG members and by members of thepublic, and phishing URLs reported by APWG members into the APWG eCrime eXchange.
The APWG tracks:•Unique phishing sites. This is a primary measure of reported phishing across the globe. This isdetermined by the unique bases of phishing URLs found in phishing emails reported to APWG’srepository. (A single phishing site may be advertised as thousands of customized URLs, allleading to basically the same destination.) Thus APWG measures reported phishing sites, which isa more relevant metric than URLs. A synonym for sites is attacks.

•Unique phishing e-mails subjects. This counts email lures that have different email subject lines.
Some phishing campaigns may use the same subject line but advertise different phishing sites.
This metric is a general measure of the variety of phishing attacks, and can be a rough proxy forthe amount of phishing taking place.

•The APWG also counts the number of brands attacked by examining the phishing reports
submitted into the APWG eCrime Exchange, and normalizing the spellings of brand names.
AprilMay

June

Number of unique phishing Web sites (attacks) detected597,789

381,572

306,847

Unique phishing email campaigns

41,08330,717

22,610

544

521

498

Number of brands targeted by phishing campaigns

In the second quarter of 2023, APWG observed 1,286,208 phishing attacks. This was down from the1,624,144 attacks seen in 1Q 2023, which was the record high quarter in our historical observations. The2Q 2023 total was the third-highest quarterly tally that the APWG has ever observed. It was much higher
than the 888,585 in 4Q 2022, and about equal to the 1,270,883 phishing attacks in 3Q 2022. However,phishing fell notably by the end of the second quarter. The 306,847 attacks seen in June 2023 was thesmallest monthly total since November 2021.
The number of phishing sites seen over the last year was:3

Phishing Activity Trends Report
2nd Quarter 2023
www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 2nd Quarter 2023

In 2Q 2023, the number of unique email subjects (campaigns) received also dipped, after averaging morethan 40,000 per month in 1Q 2023. The number of total email reports that APWG received also dipped; thenumber received in June was a little more than half the number received in April.

Most-Targeted Industry Sectors – 2nd Quarter 2023
In the second quarter of 2023, APWG founding member OpSec Security found that phishing attacks
against the financial sector (which includes banks) remained the largest set of attacks, accounting for 23.5percent of all phishing -- the same as in 1Q 2023 2022. Attacks against online payment services wereanother 5.8 percent of all attacks.
Attacks against social media companies have grown to become a larger share of all attacks. In Q2 2023,
they were 22.3 percent of all attacks worldwide. That was up from 18.2 percent in 1Q 2023, 15.5 percent in
2Q 2022, and just 8.5 percent of all attacks in 4Q 2021.
OpSec Security also detected a fraud volume decrease from Q1 to Q2 2023.
Matthew Harris, Senior Product Manager, Fraud at OpSec Security, noted: “The SAAS/Webmail category
fell to third in our ranking, primarily driven by a reduction in the number of phish targeting MicrosoftOutlook.”
4Phishing Activity Trends Report
2nd Quarter 2023
www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 2nd Quarter 2023
Harris added: “Continuing trends we observed in 2022, we're again tracking a strong increase in mobile
phone-based fraud, or voice phishing. The volume of ‘vishing’ continues to rise. Quarter-over-quarter,
we are seeing a steady 10 percent increase in the number of companies being targeted by vishing.”

MOST-TARGETED INDUSTRIES, 2Q 2023
FinancialInstitution,
23.5%

Social Media,
22.3%

Gaming, 1.7%
Cryptocurrency,
2.2%
SAAS / Webmail,16.3%

Payment, 5.8%

eCommerce /Retail, 6.3%
Telecom, 6.6%

Logistics /Shipping, 6.1%

Other, 9.2%

OpSec Security offers world-class brand protection solutions.

Business e-Mail Compromise (BEC), 2nd Quarter 2023

APWG member Fortra tracks the identity theft technique known as “business e-mail compromise” orBEC, which was responsible for $50.8 billion dollars in losses between October 2013 and December 2022,according to the FBI’s Internet Crime Complaint Center (IC3). In a BEC attack, a threat actor impersonates
an employee, vendor, or other trusted party in an email communication and attempts to trick an employee into sending money, privileged information, or some other asset. Fortra examined thousands ofBEC attacks attempted during Q2 2023.

5

Phishing Activity Trends Report
2nd Quarter 2023
www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 2nd Quarter 2023
Fortra found that the average amount requested in wire transfer BEC attacks in Q2 2023 was $293,359, up
57 percent from Q1’s average of $187,053. The volume of wire transfer BEC attacks in Q2 decreased by 29
percent compared to the prior quarter. This suggests the bad actors behind BEC wire transfer incidents
focused their attention on fewer but higher-amount attacks.
During the second quarter of 2023, advance fee fraud scams were the most popular cash-out method,comprising 44 percent of the total. Attackers requested gift cards as payment 34 percent of the time.
Amazon and Apple Store cards were most popular. Payroll diversion remained a popular attack type,making up 8 percent of attempts.
The second quarter saw the emergence of hybrid vishing (voice phishing) as an attack type. Five percentof the response-based attacks Forta observed fell into this category. John Wilson, Senior Fellow, Threat
Research at Forta, said: “The hybrid vishing attacks we track typically begin as an email stating that therecipient has been charged for a product or service. The message instructs the recipient to call a phone
number if they wish to cancel the order and obtain a refund. PayPal was the most common brand used asa lure in these attacks, making up 38 percent of the total. This was followed by Geek Squad, McAfee, andNorton/LifeLock each with 19 percent of cases we observed.”

6

Phishing Activity Trends Report
2nd Quarter 2023
www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 2nd Quarter 2023
Fortra found that 87 percent of BEC attacks in Q2 2023 were launched using a free webmail address, anincrease from 73 percent in Q2 2022. The remaining 13 percent of BEC attacks in Q2 2023 utilized
maliciously registered domains and compromised email accounts.
Google’s Gmail remained the favorite email provider amongst BEC scammers, accounting for 79 percentof the free webmail accounts used in Q2 2023 BEC scams. This was up 7 percentage points compared tothe same period last year. Microsoft’s webmail properties powered 10 percent of webmail-based BEC
attacks in Q2 2023. Verizon Media, which includes Yahoo and AOL, accounted for just 2 percent of thefree webmail accounts used for BEC in the second quarter of 2023.
Fortra protects organizations against phishing, BEC scams, and other advanced email threats.
APWG Phishing Activity Trends Report Contributors

Forta's mission is to helporganizations increase security
maturity while decreasing
operational burden. Forta's brands
include PhishLabs and Agari.
www.forta.com

Illumintel provides intelligence,analysis, due diligence, and public
policy advising in the areas ofcybersecurity and Internet-based
commerce.
www.illumintel.com

OpSec Security is the leading
provider of integrated online
protection and on-productauthentication solutions for brandsand governments.
www.opsecsecurity.com

The APWG Phishing Activity Trends Report is published by and © the APWG. For info about the APWG,
please contact APWG Deputy Secretary General Foy Shiver (foy@apwg.org, +1.404.434.728). For media
inquiries related to company-provided content in this report, please contact: APWG Secretary GeneralPeter Cassidy (pcassidy@apwg.org, +1.617.669.1123); Stefanie Wood Ellis of OpSec Security(sellis@opsecsecurityonline.com); Rachel Woodford of Fortra (Agari and PhishLabs)(Rachel.Woodford@fortra.com). Analysis and editing by Greg Aaron, Illumintel Inc., illumintel.com

7

Phishing Activity Trends Report
2nd Quarter 2023
www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 2nd Quarter 2023
About the APWG
Founded in 2003, the Anti-Phishing Working Group (APWG) is a not-for-profit industry association focusedon eliminating the identity theft and frauds that result from the growing problem of phishing, crimeware,and e-mail spoofing. Membership is open to financial institutions, online retailers, ISPs, solutions providers,
the law enforcement community, government agencies, multilateral treaty organizations, and NGOs. There
are more than 2,200 enterprises worldwide participating in the APWG.
Operationally, the APWG conducts its core missions through: APWG, a US-based 501(c)6 organization;
the APWG.EU, the institution’s European chapter established in Barcelona in 2013 as a non-profit researchfoundation incorporated in Spain and managed by an independent board; the STOP. THINK. CONNECT.
Messaging Convention, Inc., a US-based non-profit 501(c)3 corporation; and the APWG’s applied research
secretariat <http://www.ecrimeresearch.org>.
APWG’s directors, managers and research fellows advise: national governments; global governance bodies
such as the Commonwealth Parliamentary Association, Organisation for Economic Co-operation andDevelopment, International Telecommunications Union and ICANN; hemispheric and global trade groups;
and multilateral treaty organizations such as
the European Commission, the G8 High Technology
Crime Subgroup, Council of Europe’s Convention onCybercrime, United Nations Office of Drugs and Crime, Organization for Security and Cooperation inEurope, Europol EC3 and the Organization of American States. APWG is a founding member of the steeringgroup of the Commonwealth Cybercrime Initiative at the Commonwealth of Nations.
APWG‘s clearinghouses for cybercrime-related machine event data sends
more than two billion data elements per month outbound to APWG’smembers to inform security applications, forensic routines and research
programs, helping to protection millions of software clients and devices worldwide. APWG Engineeringcontinues to work with data correspondents worldwide to develop new data resources.
APWG‘s STOP. THINK. CONNECT. cybersecurity awareness campaign has
officially engaged campaign curators from 26 nations, 13 of which are
deployed by cabinet-level ministries, government CERTs and national-scope NGOs.
The annual APWG Symposium on Electronic Crime Research,
proceedings of which are published by the IEEE, attracts
scores of papers from leading scientific investigators
worldwide. The conference, founded in 2006 by APWG, is the only peer-reviewed conference dedicatedexclusively to cybercrime studies.
8Phishing Activity Trends Report
2nd Quarter 2023
www.apwg.org • info@apwg.org