Phishing Activity Trends Report

1st Quarter
2020
plus
COVID-19
coverage
Unifying the
Glob a l Re sp onse
T o Cyb er cr ime
Table of Contents
Statistical Highlights for 2nd Quarter 20173

Phishing E-mail Reports and Phishing Site Trends

4

Brand-Domain Pairs Measurement

5

Brands & Legitimate Entities Hijacked byE-mail Phishing Attacks

6

Use of Domain Names for Phishing

7-9

Phishing and Identity Theft in Brazil

10-11

Most Targeted Industry Sectors

12

APWG Phishing Trends Report Contributors

13

Activity January-March 2020

Published 11 May 2020

Phishing Activity Trends Report, 1st Quarter 2020
Cyber Gangs Leverage COVID-19 to
Accelerate Cybercrime Mutation

Phishing Report Scope
The APWG Phishing Activity Trends Report analyzes
phishing attacks and other identity theft techniques, asreported to the APWG by its member companies, its
Global Research Partners, through the organization’s
website at http://www.apwg.org, and by e-mailsubmissions to reportphishing@antiphishing.org. APWG
measures the evolution, proliferation, and propagation ofidentity theft methods by drawing from the research ofour member companies and industry experts.

Phishing Defined
Phishing is a crime employing both social engineering andtechnical subterfuge to steal consumers’ personal identity
data and financial account credentials. Social engineering
schemes prey on unwary victims by fooling them into
believing they are dealing with a trusted, legitimate
party, such as by using deceptive email addresses andemail messages. These are designed to lead consumers tocounterfeit Web sites that trick recipients into divulging
financial data such as usernames and passwords.
Technical subterfuge schemes plant malware onto
computers to steal credentials directly, often using
systems that intercept consumers’ account user names
and passwords or misdirect consumers to counterfeit
Web sites.

Phishing Activity Trends Summary•

Beginning in mid-March, cybercriminals launcheda variety of COVID-19 themed phishing andmalware attacks against workers, healthcare
facilities, and the recently unemployed. [pp. 3-6]•

The number of phishing sites detected in the firstquarter of 2020 was 165,772, up from the 162,155
observed in the fourth quarter of 2019. [p. 7]•

Phishing that targeted webmail and Software-as-aService (SaaS) users continued to be biggest
category of phishing. [p. 8]•

Criminals perpetrating Business EmailCompromise (BEC) attacks prefer gift cards to cashout, but one criminal attempted a wire transfer
scam for $976,522. [pp. 9-10]•75 percent of all phishing sites now use SSL
protection. [p. 11]•

Some phishing reported to large hosting providers
can stay unmitigated for months. [pp. 12-13]•

Phishing in Brazil was up 24 percent during Q1.
Brazil has seen an outsized growth in phishingover the last year. [p. 11]

Table of Contents
Cybercrime During the COVID-19 Pandemic

3

Statistical Highlights for 1st Quarter 2020

7

Most-Targeted Industry Sectors

8

Business E-Mail Compromise (BEC)

9Online Criminal Activity in Brazil

11

Use of Domain Names for Phishing

12

How Phishers Use Encryption to Fool Users

14

APWG Phishing Trends Report Contributors

15

2
Phishing Activity Trends Report
1st Quarter 2020www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 1st Quarter 2020
Cybercrime During the COVID-19 Pandemic
Disasters have always been an opportunity for criminals—they have crafted attacks to take advantage of
hurricanes, recessions, and other difficult times, promoting fake charitable giving opportunities and nonexistent products. The COVID-19 pandemic of 2020 is unfortunately the latest example. Below the APWG
looks at four ways in which cybercriminals have taken advantage of the pandemic to deploy ever moresophisticated scenarios to lure their prey.

Zoom Users Become Targets
In March 2020, the APWG received just eight reports to its eCrime eXchange of phishing attacks against
videoconference service Zoom’s brand and its users. But in April, APWG received reports of 1,054 attacks
against Zoom.
Some of the attacks were phishing attacks, in which phishers emailed out fake Zoom video-conferencing
meeting notifications. These took victims to Web pages set up by the phishers, designed to steal Zoom
account usernames and passwords from unwary users. Phishers can use these credentials to log in tocorporate video conferencing accounts, and can try the harvested passwords on other sites and services.
Other attacks offered Internet users the opportunity to download the Zoom client. But instead, thesedelivered malware files. This download was an example:
Zoom is a video-conferencing andchat application, and it was popularwith businesses before the pandmeic.
But Zoom usage exploded in March
2020 as companies sent theiremployees to work from home andschools switched to distance learning.
According to Zoom, its user basedoubled from 100 million to 200
million daily meeting participants inthe short time between December 2019
and the end of March 2020.

3
Phishing Activity Trends Report
1st Quarter 2020www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 1st Quarter 2020
APWG member companies submit phishing reports into the APWG’s e-Crime Exchange (eCX), whereother members can see the data and use it to protect Internet users around the world. The data shows
how phishers have targeted an Internet service that has become essential during the pandemic: Zoom.
The attacks reported to APWG eCX were not Zoom’s fault – as any popular service tends to attract
malefactors. (And other video-conferencing providers such as Skype and Cisco Webex were also
attacked.) But these and other attack vectors did require Zoom to upgrade its security in a variety of ways
to secure a rapidly expanding base of everyday users.

Criminals Use Covid-19 in Business Email Compromise Attacks
APWG member and Trends contributor Agari has also been tracking COVID-19 phishing attacks. “Ourdata indicates that COVID-19 phishing attacks started spiking the week of March 8. That was the same time that
COVID-19 started to spike as a topic of general public interest according to Google Trends,” said Crane
Hassold, Senior Director of Threat Research at Agari.
Agari identified what may have been the first documented use of the pandemic as a lure in a “Business
Email Compromise” or BEC attack. In a BEC attack, a scammer targets employees who have access tocompany finances, usually by sending them email from a fake or compromised email account (a “spear
phishing” attack). The scammer impersonates a company employee or other trusted party, and tries to trick
the employee into sending money.
On March 11, a criminal group that Agari calls "Ancient Tortoise" reached out to a company and posed as
one of the company’s real suppliers. The criminal requested that the company pay past-due invoices, andused the coronavirus as a pretext to provide new payment details to the victim. The criminal explainedthat the outbreak had forced the supplier to change the bank it was using to receive payments. The new
account turned out to be in Hong Kong, from which the criminal could retrieve funds via money mules.

Above: the attacker used a look-alike domain to spoof the target company.
Note: Names and domains used have been changed above to protect the victim.
4
Phishing Activity Trends Report
1st Quarter 2020www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 1st Quarter 2020

In a different attack, a criminal asked a potential victim to send gift cards that would supposedly be given
to sick miltary veterans:

This is yet another example of how cybercriminals exploit global trends for their own ends.

Criminals Attack Healthcare Facilities During the Pandemic
On March 26, i3 reported that ransomware attacks on healthcare facilities were up 35 percent, versus
similar attacks from 2016 through 2019. Healthcare providers must prevent disruptions to patient care,and criminals saw them as targets that would likely pay ransom. RiskIQ found that 70 percent of thehealthcare attacks it analyzed were directed at healthcare facilities with fewer than 500 employees. It
appears that attackers targeted smaller direct-patient care facilities because they might have smaller
security budgets.
On March 9, APWG member and Trends contributor RiskIQ put its Incident Investigation & Intelligence(i3) analyst team on the COVID-19 problem. The i3 team began collecting disparate kinds of data into
comprehensive daily updates to help raise the situational awareness of security teams around the world.
In mid-March, i3 predicted that threat actors would begin using ransomware against companies andorganization in healthcare and related fields. By March 19, cybercriminals were spreading malware byadding text from COVID-19 news stories in attempts to bypass security software that uses artificial
intelligence and machine learning to detect malware.

5
Phishing Activity Trends Report
1st Quarter 2020www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 1st Quarter 2020
COVID-19 Fraud: A Worldwide Problem
Cybercriminals have adopted a variety of tactics during the pandemic, some of which vary by region. In
Brazil, APWG member and Trends contributor Axur found a fake site disseminated via the WhatsApp
instant messaging application. It created a network of “shares,” resulting in a massive dissemination of
the fake ads on mobile devices. The ad claimed to be an official registration for the immediate withdrawalof money from the Brazilian government’s Severance Indemnity Fund (Fundo de Garantia do Tempo deServiço—FGTS). This is the government unemployment fund, of interest to workers laid off during the
pandemic. This fraud used the generic name: auxiliocorona.online.

6
Phishing Activity Trends Report
1st Quarter 2020www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 1st Quarter 2020
Statistical Highlights for 1st Quarter 2020
January

February

March

Number of unique phishing Web sites detected

54,92649,56060,286

Number of unique phishing e-mail reports (campaigns)

52,40743,27044,008

374

331

344

received by APWG from consumers
Number of brands targeted by phishing campaigns

APWG’s contributing members report phishing URLs into APWG, and study the ever-evolving natureand techniques of cybercrime. The APWG tracks the number of unique phishing Web sites, a primarymeasure of phishing across the globe. This is determined by the unique base URLs of the phishing sites.
(A single phishing site may be advertised as thousands of customized URLs, all leading to basically thesame attack destination.)
The total number of phishing sites detected in the first quarter of 2020 was 165,772. That was up slightly
from the 162,155 in Q4 2019. The trend since November 2019 has been headed upward:

Phishing Sites, 4Q2019-1Q2020
90,00080,00070,00060,00050,00040,00030,00020,00010,0000
Oct-19

Nov-19Dec-19Jan-20Feb-20Mar-20APWG also tracks the number of unique phishing reports (email campaigns) it receives from consumers
and the general public through the reportphishing@apwg.org service. An e-mail campaign is a unique email sent out to multiple users, directing them to a specific phishing web site (multiple campaigns may
7
Phishing Activity Trends Report
1st Quarter 2020www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 1st Quarter 2020
point to the same web site). APWG counts unique phishing report e-mails as those found in a given
month that have the same email subject line. The number of these unique phishing reports submitted to
APWG during 1Q2020 was 139,685. This was up from 132,553 in 4Q2020, 122,359 in 3Q2020 and 112,163 in
2Q2020. These were phishing emails submitted to APWG, and does not count phishing URLs reported by
APWG members directly into APWG’s eCrime Exchange.

Most-Targeted Industry Sectors – 1st Quarter 2020
In the first quarter of 2020, APWG member OpSec Security found that SaaS and webmail sites remained
the biggest targets of phishing, with 34 percent of all attacks. “In February we detected a dip in attacks
against the payment sector,” noted Stefanie Wood Ellis, Anti-Fraud Product & Marketing Manager at
OpSec Online. “That dropped Payment-targeted phish to only 13 percent of all targets, when in thepreceding four quarters the Payment sector had been 20 percent of all phishing.” OpSec (a founding
APWG member formerly known as MarkMonitor) offers world-class brand protection solutions.

MOST-TARGETED PHISHINGSECTORS, 1Q202
Payment, 13.3%
Financial
Institution,
19.4%

Social Media,
8.3%

Other, 6.9%

eCommerce /Retail, 6.2%

Cloud Storage /File Hosting,
3.9%
Other, 8.5%

SAAS / Webmail,33.5%

8
Phishing Activity Trends Report
1st Quarter 2020www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 1st Quarter 2020
Business e-Mail Compromise (BEC), 1st Quarter 2020
APWG member Agari tracks the identity theft technique known as “business e-mail compromise” or BEC.
In a BEC attack, a scammer targets employees who have access to company finances, usually by sending
them email from fake or compromised email accounts (a “spear phishing” attack). The scammer
impersonates a company employee or other trusted party, and tries to trick the employee into sending
money. The attacker may prepare by spending weeks inside the organization’s network and accounts,
studying the organization’s vendors, billing system, and even the CEO’s style of communication. BEC
attacks have caused aggregate losses in the billions of dollars, at large and small companies.
Agari examined thousands of attempted BEC attacks it observed during Q1. Agari counts BEC as any
response-based spear phishing attack that involves the impersonation of a trusted party (a company
executive, vendor, etc.) to trick a victim into making a financial transaction or sending sensitive materials.
Agari protects organizations against phishing, BEC scams, and other advanced email threats.
Agari found that scammers requested funds in the form of gift cards in 66 percent of BEC attacks, up from
56 percent during the third quarter of 2019. About 16 percent of attacks requested payroll diversions,
down from 25 percent in Q3. Some 18 percent requested direct bank transfers.

BEC CASH-OUT METHOD, 1Q 2020
DirectTransfer,
18%
Gift Cards,
66%
Payroll
Diversion,
16%

The amount of money that an attacker can make by getting gift cards is significantly less than he can getwith a wire transfer. During the first quarter of 2020, the average amount of gift cards requested by a BEC
attacker was $1,000. Scam attempts around this dollar amount may have a decent chance of success,because they can be approved by multiple people in a medium-to-large company, and the amount issmall enough to slip by some companies’ financial controls.
9
Phishing Activity Trends Report
1st Quarter 2020www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 1st Quarter 2020
On the other hand, BEC attacks that ask for wire transfers are after much larger amounts. The average
BEC wire transfer attempt requested in Q1 was for over $54,000:
Average

MedianMin

Max

Wire transfer requests$54,006$29,726$800$976,522

Gift card requests$1,453$1,000$100$15,000

Agari watched one criminal attempt a big score – a wire transfer request for $976,522. This was muchlarger than the biggest request that Agari observed in Q4, which was for $680,456.
According to Crane Hassold, Agari’s Senior Director of Threat Research, “In the first quarter of 2020, eBay
overtook Google Play as the most popular type of gift card requested by BEC scammers. That signals apretty significant shift since Google Play had been the predominant type of gift card requested in BEC
attacks for more than a year.” The increase could be due to the fact that eBay sells physical goods – as doother popular BEC card requests, such as Walmart, Target, Amazon, and Best Buy. It may indicate thatscammers are looking to launder money by using the cards to buy physical goods that they can then sell.

GIFT CARDS REQUESTED IN BEC ATTACKS,
1Q2020
Other, 14.0%

eBay, 19.3%

Best Buy, 4.5%
Apple Store,
4.8%
Google Play,
12.9%

Walmart, 5.5%

Target, 7.0%
iTunes, 12.9%

Amazon, 8.6%
Steam, 10.4%

10Phishing Activity Trends Report
1st Quarter 2020www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 1st Quarter 2020
Online Criminal Activity in Brazil
APWG member company Axur is located in Brazil and concentrates on protecting companies and theirusers in Brazil from Internet-based threats. Axur especially monitors attacks against banks, technology
firms, airlines, and online marketplaces located in the country. Axur’s data shows how criminals areperpetrating identity theft in South America’s largest economy, and shows how these incidents are both alocal and international problems.
Between January 1 and March 31, 2020, Axur observed 10,910 cases of phishing. Specifically, these wereattacks against Brazilian brands or against foreign services that are available in Portuguese in Brazil. That
was an increase of 24 percent compared to the fourth quarter of 2019, when Axur detected 8,782 cases.
And the 1Q 2020 numbers were a notable increase of 239 percent from the same period in 2019, when
Axur observed 3,220 cases. In other parts of the world, phishing did not leap so dramatically during thesame time period.

Phishing Cases Detected in Brazil,
January 2019 to March 2020
4,500
4,000
3,500
3,000
2,500
2,000
1,500
1,000
500
0

3,8453,766
2,751 2,908

2,645
2,267
1,820
1,236

Jan-19 Feb

942

Mar

2,150

3,123 3,299

2,067

1,042 1,210

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec Jan-20 Feb

Mar

From the last quarter of 2019 through the first quarter of 2020, Axur saw attacks increase against banks.
For the first time in Brazil, banks and financial institutions were the sector most affected by phishing,accounting for some 40 percent of the quarterly total:

11
Phishing Activity Trends Report
1st Quarter 2020www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 1st Quarter 2020

Phishing Attacks by Target Category, Brazil, 4Q2019-1Q2020
4,500
4,000
3,500
3,000
2,500
2,000
1,500

1,000
500
0
Oct-19

Nov-19Frequent-Flyer Programs/Airlines

Dec-19OthersJan-20e-Commerce

Feb-20Banks/Lenders

Mar-20

SaaS/Webmail

Attacks against e-commerce sites decreased, but still accounted for a third of attacks in 1Q 2020. Attacks
against e-commerce sites are more prevalent in Brazil than elsewhere.

Use
Names and Hosting for Phishing
wereofinDomain.C
APWG member RiskIQ provides ongoing analysis of where phishing is happening in the domain namesystem. RiskIQ analyzed 1,766 confirmed phishing URLs reported to APWG in Q1 2020. RiskIQ foundthat they were hosted on 983 unique second-level domains (and 19 were hosted on unique IP addresses,
without domains). RiskIQ provides digital risk protection by illuminating risk associated with anorganization’s digital presence.
There are three types of top-level domains (TLDs) for purposes of this report:•“Legacy” generic TLDs, which existed before 2011. These include .COM, .ORG, and TLDs such as.ASIA and .BIZ. They represented about 48 percent of the domain names in the world as of the
beginning of 2020, and represented 65 percent of the phishing domains in the sample set. There
were 640 legacy gTLDs in the sample set. Most of those were in .COM, which had 521 domains inthe set.

12
Phishing Activity Trends Report
1st Quarter 2020www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 1st Quarter 2020•

The new generic top-level domains (nTLDs), such as .WORK and .ICU, were released after 2011.
At the beginning of Q1, the nTLDs represented about 8 percent of the domains in the world, andwere about 8 percent of the domains in the sample set. There were 75 nTLD domains in the sample
set.

•

The country code domains (ccTLDs), such as .UK for the United Kingdom and .MX for Mexico.
ccTLDs were about 44% of the domains in the world as of the beginning of Q1, but were only 27
percent of the domains in the Q1 sample set. The .UK ccTLD maintains registration for 8 percent(13 million) of ccTLDs in the world, but represented 15 percent of the ccTLD domains in thephishing set. The chart below shows the TLDs that had the most unique second-level domains
used for phishing.

The chart below shows the TLDs that had the most unique second-level domains used for phishing:
Rank

TLD

Category# of Unique Domains
in Sample Set (1Q 2020)

1
2
3
4
5
5
6
7
7
7
8
9
9
10
10

.com
.net
.org
.uk
.info
.br
.ru
.au
.live
.me
.kr
.in
.xyz
.cf
.ga

gTLD
gTLD
gTLD
ccTLD
ccTLD
gTLD
ccTLD
ccTLD
nTLD
ccTLD
ccTLD
ccTLD
nTLD
ccTLD
ccTLD

521
43
41
39
29
29
15
11
11
11
10
9
9
7
7

RiskIQ also analyzed a set of 3,041 unique domain names used for phishing during the period fromJanuary 1 through March 31; all hosted phishing that attacked companies in the financial sector. RiskIQ
then scanned the same unique domains for analysis on May 3, 2020, more than a month after the lastphishing report. As of May 3, 2020, 43 of the unique domains were still hosting phishing pages; all 43 hadbeen reported by RiskIQ to the responsible hosting providers during Q1.
Some of these phishing attacks were re-activated, but most of the 43 had never been taken down by thehosting providers. Of the 43 domains still being used for phishing, almost half here hosted by Unified
13
Phishing Activity Trends Report
1st Quarter 2020www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 1st Quarter 2020
Layer (AS46606), a hosting unit of Endurance International Group, one of the Internet’s largest hosting
providers. “The parent company, Endurance, was ultimately responsive to the concern, but we continue
to monitor the situation,” says Jonathan Matkowsky of RiskIQ’s Incident Investigation & Intelligence (i3)group.

How
were Phishers
in .COM,Use Encryption to Fool Victims
APWG Trends contributor PhishLabs has been tracking how many phishing sites are protected by the
HTTPS encryption protocol. HTTPS is used to secure communications by encrypting the data exchanged
between a person’s browser and the web site he or she is visiting. HTTPS is especially important on sitesthat offer online sales or password-protected accounts. Studying HTTP on phishing sites provides insight
into how phishers are fooling Internet users by turning an Internet security feature against them.
PhishLabs provides managed security services that help organizations protect against phishing attacks
targeting their employees and their customers.

% of Phishing Attacks Hosted on HTTPS% OF PHISHING ATTACKS

80%
70%
60%
50%
40%
30%
20%
10%
0%
Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1
2016 2016 2017 2017 2017 2017 2018 2018 2018 2018 2019 2019 2019 2019 2020

QUARTERIn Q1 2020, a new high of 74 percent of sites used for phishing were protected with SSL. “The majority ofphishing web sites continue to use SSL/TLS,” said John LaCour, Founder and CTO, PhishLabs. “We hopethat users have learned that SSL doesn’t mean a site is legitimate. Virtually every web site—good andbad—now uses SSL.” Phishers often mount phishing pages within legitimate sites that use SSL.
14
Phishing Activity Trends Report
1st Quarter 2020www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 1st Quarter 2020
APWG Phishing Activity Trends Report Contributors

Agari protects organizations

Axur works to identify and fightagainst phishing, business email

the threats in the cyberspace thatcompromise (BEC) scams, andinterfere with the interests ofother advanced email threats.

companies, governments, andIllumintel provides intelligence,
analysis, due diligence, and public
policy advising in the areas ofcybersecurity and Internet-based
commerce.

individuals.

PhishLabs provides managed
OpSec Online™ (formerly

threat intelligence and mitigation

founding APWG member

services that protect brands,

MarkMonitor®), offers world classcustomers, and the enterprisebrand protection solutions.

from digital risks.

RiskIQ is a digital threat
management company enablingorganizations to discover,understand and mitigate known,
unknown, and malicious exposure
across all digital channels

About the APWG
Founded in 2003, the Anti-Phishing Working Group (APWG) is a not-for-profit industry association focused on
eliminating the identity theft and frauds that result from the growing problem of phishing, crimeware, and email spoofing. Membership is open to qualified financial institutions, online retailers, ISPs, solutions providers,
the law enforcement community, government agencies, multi-lateral treaty organizations, and NGOs. There are
more than 2,000 enterprises worldwide participating in the APWG.
APWG maintains it public website, <http://www.antiphishing.org>; the website of the STOP. THINK.
CONNECT. Messaging Convention <http://www.stopthinkconnect.org> and the APWG’s research website<http://www.ecrimeresearch.org>. These are resources about the problem of phishing and Internet frauds– andresources for countering these threats. The APWG, a 501(c)6 tax-exempted corporation, had its first meeting inNovember 2003 in San Francisco, and was incorporated in 2004 as an independent corporation controlled by its
board of directors, its executives and its steering committee.
The APWG Phishing Activity Trends Report is published by the APWG. For further information about the APWG, pleasecontact APWG Deputy Secretary General Foy Shiver (foy@apwg.org, +1.404.434.728). For media inquiries related to thecompany-content of this report, please contact APWG Secretary General Peter Cassidy (pcassidy@apwg.org,+1.617.669.1123); Stefanie Ellis at OpSec Security (Stefanie.ellis@markmonitor.com); Jean Creech of Agari(jcreech@agari.com, +1.650.627.7667); Eduardo Schultze of Axur (eduardo.schultze@axur.com,+55 51 3012-2987); Stacy
Shelley of PhishLabs (stacy@phishlabs.com, +1.843.329.7824); Kari Walker of RiskIQ (Kari@KariWalkerPR.com,

15+1.703.928.9996). Analysis and editing by Greg Aaron, Illumintel Inc., www.illumintel.com

Phishing Activity Trends Report
1st Quarter
2020
PWG thanks
its contributing members, above, for the data and analyses in this report0.
www.apwg.org • info@apwg.org