F-SecuredYour complete guide toonline security in 2023
Uncover the top cyber security risks
Learn how to deal with threats
Discover the hottest security trends
Get the malware lowdown for 2023
And much more inside!

Executive summary
The F-Secured guide provides acomprehensive overview of thecyber security threats facing
consumers in 2023. But we needto address these issues in a waythat people can relate to,because, in the words of F-Secure
CEO Timo Laaksonen:“Consumers find protecting theirdigital moments far too complex
and confusing.”
And so the F-Secured guidefocuses on delivering accessible,
consumer-focused advice andinsight, supported bycomprehensive expertise frommultiple experts at F-Secure. Key
topics in the F-Secured guideinclude:MALWARE AND INFOSTEALERS. We review the current malware

outlook for 2023, where campaigns will be dominated by information stealing
malware (with 69% of the top 30 malware threats we observed in 2022 being
information stealers, also known as ‘infostealers’).

SECURITY AND THE SMART HOME. According to Statista, by 2025

the number of connected devices in the average household will hit 34. This
increase in connected devices poses a number of challenges for consumers,
hardware manufacturers, and CSPs (communication service providers). We
review these challenges with Tom Gaffney, a connected home expert at
F-Secure.

PHISHING FOR NEW VICTIMS. Phishing is an ever-present threat, andwhilst it continues to be an effective route for cyber criminals, they are always
looking for new areas to exploit. In the F-Secured guide we review the
emerging trends for 2023, with a focus on how gaming and social media areproviding new opportunities for scammers.

CYBER SECURITY IS GETTING PERSONAL. F-Secure’s threat

intelligence lead, Laura Kankaala, looks at the increasing issue of relationshipdynamics in cyber security, with a focus on stalkerware and security issues
that arise from changing personal circumstances. As Kankaala notes: “We areexposing ourselves to new kinds of tracking and privacy related concerns.”

TRENDS AND PREDICTIONS FOR 2023. With a dedicated team ofresearchers, analysts, and threat hunters working behind the scenes, F-Secure
operates at the leading edge of cyber security. And on this guide we havespoken to some of the company’s brightest minds, showcasing their trends
and predictions for 2023.

2

F-Secured Your complete guide to online security in 2023

Contents

3

4

Malware today

8

The connected home and security

12

Cyber Security CSI: 5 top threats

23

Master your passwords

25

5 killer phishing scams

31

How cyber security is getting personal33

12 trends and predictions

F-Secured Your complete guide to online security in 2023

MALWARE

Malware today
Malware. It’s the threat that has been pestering us for
decades. And here we take a look at the current outlook.

M

alware, or malicious software,is an umbrella term for all kindsof software intended to cause
harm. Criminals and somegovernment organizations across the globe
use malware to spy on people and systems,
to steal data, personal details andpasswords, and to damage devices andsystems. Some of the most alarming
modern malware, with many functionalities,
can be used for highly sophisticated attacks.
Computer viruses, trojans, ransomware,
worms, spyware, etc. are all malware.

information, such as bank credentials, todirectly steal money.
These goals were also fueling malware
operators in 2022. On Windows, themalware campaigns which directly affectedconsumers mostly involved delivery of
information stealing malware. In fact, 69% of
the top 30 malware threats we observed
were information stealers, also known as
infostealers. And 28% were Trojan
downloaders, which aim to download othermalware. (Source: ‘Windows threat type
distribution’ on page 13.)

Malware in 2022

Information stealers

When looking at 2022 as a whole, stealing
information and using it for financial gain
was a prevalent threat to consumers.
Among many other ways, criminals profit
from stolen information by selling personal
details and credit card numbers to othercriminals; using stolen data for identity theft;hijacking accounts; and using the4

F-Secured Your complete guide to online security in 2023

Information stealers do what the namesuggests. Once installed, they collectinformation from the victim’s device. This
includes data stored on browsers, like saved
passwords and auto-fill data, system
information, what software the device isrunning, email credentials, and more. Somevariants of information stealers are capable

MALWARE“RedLine Stealer was
one of the most popularmalware tools.”of capturing screenshots, keystrokes, andeven hijacking cryptocurrency wallets.
Through 2022 malware was spread using
current events and topics as lures, such as
Covid-19, NFTs and Windows 11. Gamingrelated lures, such as cheat code files, links
to sites for installing computer performanceenhancing software, cracks for popular
software, and shareware sites were alsoheavily used to spread malware. The lures
were spread in email, websites, links in
YouTube videos, and in social media
channels like Discord.

RedLine Stealer

One of the most notable and prevalent
information stealers that was actively
distributed throughout 2022 was RedLine
Stealer. It is a good example of a modern
malware-as-a-service business model.
Someone creates a piece of malware andthen sells it to other criminals, who can then5

F-Secured Your complete guide to online security in 2023

use it for their own purposes. The creator
profits without having to spread themalware themselves, which they of course
can also do. And when they have the option
to simply buy it online, criminals without thecapability or skills to create effective
malware can use an off-the-shelf version tolaunch their own malware attacks.
Through 2022 RedLine Stealer was one of
the most popular malware tools offered in
the dark web marketplaces. One of its
benefits for criminals is that this malware ismodular: buyers can choose what
capabilities they want to use. The priceranges from $100-$800 depending on thesubscriptions and offerings. (You can readmore about RedLine Stealer on page 13.)

Ransomware

In 2022, ransomware operators continued toconcentrate their efforts on organizations,such as schools, universities, government

MALWARE

entities, medical institutions, and so on. And
during 2022, only 1% of blocked malware
threats were ransomware (in F-Secure’s top
30 malware threats).
However, this does not mean thatransomware poses no threat to online users,
as the attacks often involve data exfiltration.
This places user data at risk of being
breached and sold on the dark web. And
while ransomware was not a major direct
threat to consumers in 2022, it has notvanished either.

Mobile malware

Based on F-Secure data, there was a rise inmobile threat infection hits from 2021 to
2022 on the Android operating system.
Some of these threats were malicious apps
in the Google Play Store. These apps were
imitating popular and free apps to lure users
to install malware, like banking trojans.
Another notable distribution channel was
hiding a trojan inside unofficial versions of
popular apps. These apps were promotedwith advertisements shown in free andcommonly used apps. Following the link andinstalling the app from an unofficial app
store resulted in malware infection. (You canread more about one such Trojan, known as
Triada, on page 17.)
And 66% of the mobile malware
detections in 2022 were PUAs (potentially
6

F-Secured Your complete guide to online security in 2023

“66% of the mobile
malware detections in
2022 were PUAs.”
unwanted applications). While not always
malware, these apps can perform
unwanted tasks, such as collecting
information or showing ads. They can posea risk to your privacy and sometimes include
malicious modules. Potentially Unwanted
Applications often come bundled withanother app and work with the same app
permissions.

SharkBot banking trojan

While Google Play tries to filter malware,some get through. In 2022 Google Play Store
was a popular channel for distributing
malicious apps, like banking Trojans. They
aim to intercept your banking information
which criminals can use to steal money.
SharkBot was one of the notable mobilebanking trojans distributed in Google PlayStore. It was posing as different kinds of
security and utility apps, like antivirus,

cleaners, or file manager apps. SharkBot
was spread in the UK, Germany, Italy, Spain,
Poland, Austria, the US, and Australia.
(One example targeted Italian users. In thiscampaign SharkBot was posing as a faketax code calculator. As the final stage of this
attack, the user was asked to update theapp. This update downloaded SharkBot, andit took place right after the app was
installed.)
SharkBot, like many other banking Trojans,
can show a screen overlay on top of actualbanking apps. These overlays can lookidentical to actual banking apps, and it canbe very difficult for the victim to realize
what’s happening.
:

Looking towards 2023

F-Secure kept users safe from all of theabove threats in 2022. If you don’t yet have it,
now is a good time to get protected.
As Maria Dacuno, Senior Researcher at
F-Secure puts it: “Threat actors will continue
to target information or any data that they
can use for financial gain.”
Therefore, it’s more thanlikely that in 2023 (andfurther) we will be seeing
more infostealers andscams that try to trick you.

SharkBot posing as an app for
calculating tax code in Italy(Source: Threat Fabric.)

MALWARE

7 malware tips

Recommendations for staying safe against malware.

1 MOBILE MALWARE

Mobile malware has been on the rise for the last two years. We strongly
recommend that you avoid using unofficial builds of apps for mobile
devices. Install apps only from official sources, like Google Play,
Samsung Galaxy Store and Apple App Store.

2

4

PREVENT INFECTION alware usually tries to avoid detection, so it won’t be removed. Therefore, it isM
always easier to prevent malware infection than to deal with one. Avoiding risks, likeunknown links, attachments and applications, and using an internet security solution
are the best ways you can protect yourself against malware.

5 SCAN FOR VIRUSES

Regularly scan for viruses. If it finds an infection,change credentials/passwords immediately foraccounts that may have been stolen, such as
credentials for software clients installed on theinfected machine and online services you havevisited.

CHECK REVIEWS

 e on your guard also in official app
Bstores. Check the user reviews and lookfor fake comments. An app with only
5-star reviews and very poor reviews
could possibly mean that the users haveexperienced some unusual or bad
activities after installation.

6

AVOID UNKNOWN SOURCES
On desktop computers, also avoid unknown
sources and have your internet security readywhen downloading and installing. Avoid gamecheats and cracked and pirated installers on
share and freeware sites, as it’s common forthreat actors to deliver trojans hidden within
them.

3 SCAN REGULARLY se reputable security and utility apps andUscan regularly to make sure no malware
infection is found. If the scan detects aninfection, make sure to uninstall themalicious app. Don’t use the device forfinancial transactions and don’t use
banking apps on the device.

7

F-Secured Your complete guide to online security in 2023

7 NO AUTO-FILL

Avoid saving information
to your browser auto-fillsettings, as these arecommon targets for
information stealers.

THE CONNECTED HOME

The connected
home andsecurity in 2023
In this Q&A we speakto Tom Gaffney, whoplays a critical role inpromoting F-Secure’s
Connected Home
Security initiative.

8

F-Secured Your complete guide to online security in 2023

A

ccording to Deloitte there are
now 22 connected IoT (internet ofthings) devices in the averagehome within the United States.
And analysts believe this number willcontinue to increase, with Statista claimingthat by 2025 the number of connected
devices in the average household will hit 34(Source: Statista).
This increase in connected devices posesa number of challenges for consumers,
hardware manufacturers, and CSPs
(communication service providers). And, inthe wake of 2016’s infamous ‘Mirai’ botnet,
which infected over 600,000 IoT devices at
its peak, security is now an ever-present
concern in the connected home.

In this Q&A, we speak to Tom Gaffney
about the emerging importance ofprotecting our IoT devices. Gaffney has
spent a decade working at F-Secure,serving in various technical and customer
experience positions, and he now plays acritical role in promoting F-Secure’s
Connected Home Security initiative.
Here we discuss emerging threats within
the connected home, the challenges facedby consumers and CSPs, and theopportunities that technologies such as
containerization and virtualization can
provide when it comes to security and IoT.

THE CONNECTED HOME

“Everything isfinancially motivated.
It’s all about money.”
Why are cyber criminals targeting
Q the connected home?
Everything is financially motivated. It’s
all about money. So cyber criminals will
go where the money is, and where themoney is for them centers around volume
and vulnerability. The Mirai botnet in 2016
was a game-changing moment, because it
focused the attention of cyber criminals on
the connected home.
Mirai used a brute force password attack.
It would use different password
combinations—such as ‘admin’, ‘password’,‘password 1234’, things like that—and there
were so many IoT devices that failed in that
security model, that it spread like wildfire,ultimately affecting 10s of millions of devices
around the world. So we went froma point in 2016, where we
had a handful IoT
vulnerabilities, to today,
where we’re at over
5,000.

A

9

F-Secured Your complete guide to online security in 2023

What does 2023 look like,Q in relation to IoT threats in theconnected home?
In some sense it will be business as
usual, in that we expect the criminals tostill target IoT devices, as they have hadgreat success compromising many IoT
devices to date, particularly routers, printers
and IP-cameras. One evolution we haveseen, and that I expect will grow, is the role ofnation states looking to compromise IoT
vulnerabilities. Already we’ve seen what we
believe are attacks originating from Russia
on routers, but industrial control systems
and national infrastructure are also key
targets.

A

What are the key developments
Q taking place in IoT right now?
In the world of the connected home, we
see increasing opportunities for CSPs
to provide better protection for home users

A

Q
AI s it easy to tell if yourIoT device has been
compromised?

The only visible impacts
that we’re aware of is you
might see a slowdown on yourInternet connection. That’s it.
You wouldn’t see anything else.
And partly that’s because of
how hackers are using
compromised devices, which is
to pool them together to launch
denial of service (DDoS) attacks
and spam campaigns, which
they can then monetize.
It’s all about scale. If cybercriminals can send out 10 million
spam messages and get a 0.1%
hit rate, that’s good enough.
Elsewhere, a more recent area
where we’re seeing IoT devices
being used is in the mining of
cryptocurrency. To crack theprime numbers involved in
crypto mining you need lots ofcomputing power. So, again,
criminals are using thecomputing power of individual
devices to form part of a bigger
network.

THE CONNECTED HOME

“There’s just no reason
for a mail server to be
baked into a fridge.”
and also add value to their core-connectivity
offering, by adding home network
protection.
At the same time there are some exciting
developments taking place in the field of
virtualization and containerization that will
make it easier for operators to deploy
third-party services, such as security intohome gateways (routers). F-Secure is anactive member of bodies such as the
Broadband Forum and the PRPL foundation,
which are creating an open, standardsbased approach to delivering OTT(over-the-top) services that will significantly
shorten time to market and improve
lifecycle management.

What are you main concerns
Q about IoT?
I have two concerns: security andprivacy. I am a technophile, and assuch I often have reservations about
security models, so I will look at connectedA

10

F-Secured Your complete guide to online security in 2023

home products in a very detailed way. For
example, I have a smart heating system,
and I chose my vendor very carefully. And
the driving force behind my choice of vendor
was the security model.
My second concern is privacy, and this is
why I don’t use smart speakers. This isbecause I’m very uncomfortable with themass collection of data, and how they use it
to create a mosaic of data about you. And in
the last five or six years we’ve seen IoT
goods come onto the market that breakmany security practices, because thecompany that’s created it doesn’t have asecurity background.

Would standardization or
Q legislation help?
We don’t have a CE standard for
security, and that could really help.
Obviously, we have a CE standard forelectrical items, which tells you that it’s been
properly fire tested, power tested etc. But

ATHE CONNECTED HOME

“A major issue is how
long you’ll have certain
devices for.”when it comes to security, nobody’s got aclue, and it wouldn’t be that hard to
implement, certainly in regulated markets
like the European Union.
Also, in relation to Europe, EU legislation
will come into effect at the start of 2024
which will require IoT manufacturers to
improve the security in IoT devices, or they
will not be able to legally sell in Europe. And it
will be interesting to see how manufacturers
will respond. I expect large corporations toreact positively, but many smaller
companies will struggle. At the same time, itwill be interesting to see how the EU will beable to police this.

Q

I s it enough to tell consumers they
are secure, or do you also need toshow them?

We provide a visual overview for
consumers, illustrating whether they’reprotected, how many threats that might
have been detected, and that kind of thing.

A

11

F-Secured Your complete guide to online security in 2023

And communicating this information isreally important to people; giving them thatsense of security. It’s fine telling someone
they’re secure, but it’s really important tomake it tangible.

And there’s just no reason for a mail server
to be baked into a fridge.

Q

IoT threats are just one element ofpotential vulnerability that we coverwith F-Secure Sense and Total.
The products we offer work together.
Endpoint security is the most powerfulprotection you can have, purely because it’s
working at an operating system level. It caninteract directly with the operating system.
But it has limitations, because there are
devices where we can’t add security
software at the operating system. And whenit comes to connected devices, they’reusually Linux based. So F-Secure will nevermake antivirus software for your connected
toaster or fridge. And that’s where the Sense
product comes in. So it’s a symbiotic
relationship between our products, which
delivers the best protection.

Are IoT devices particularly
vulnerable to cyber attacks?

A major issue is how long you’ll havecertain devices for. You will replace
things like phones and laptops every coupleof years, but you’ll have your fridge for a
decade, possibly. And then you think aboutindustrial goods, where these things aregoing to be on an even longer update cycle,of maybe 20-30 years. But what happens
when support is withdrawn? Does thatmean your smart fridge suddenly stops
working? And those are very real risks. And
then you have to consider the reason whythat fridge is Internet connected in the firstplace. Samsung makes a fridge which
effectively contains a mail server built into it.

AQA

How does F-Secure help protect
devices in the home?

QA hat future benefitsWmight CSPs get fromadding network
security?

For security reasons, weneed to see devices on a
network, so we can apply theright security policies. And this
could ultimately be a service initself. Operators can derive
benefit from it, because they
can see what devices areconnected, whether there are
any issues (especially regarding
Wi-Fi), and then diagnose themremotely. That’s very deep
technology. And it could
eventually help CSPs selfdiagnose and self-heal,
especially when it comes to
Wi-Fi issues, before thecustomer even considers calling
their helpdesk to make acomplaint or raise a ticket. And
these are areas where we’re
working closely with partners, toopen up new ways to add value.

CYBER SECURITY CSI

Cyber Security
CSI: 5 top threats
We hear about the latest threats. But what do they actually
look like? And how do they affect their victims? We reveal all.

A

cyber crime scene could be
anywhere. It could be on the desk
in a child’s room. Or on a laptop
trying to get free airport Wi-Fi in
Prague. It could even be sitting in yourpocket, and you may not know that for days,
weeks or months.
Unfortunately, too many of us will be
victimized by cyber criminals. Nearly one inthree internet users say they’ve dealt withcyber crime in the last 12 months, according
to a recent F-Secure survey.* The datashows that the more active you are online,
the more likely you are to be a victim. One inten report that they have been hit bymalware or a virus or premium SMS scams,
while about one in 20 say they’ve dealt with
an email hack, unauthorized access to theirsocial media accounts, or credit card fraud.
The effects of cyber crime range fromemotional distress to financial losses. More

12

F-Secured Your complete guide to online security in 2023

than six in ten victims of cyber crime (62%)
say they experienced stress. A majority(51%) say the crime robbed them of time.
And more than two in ten (22%) say that theyexperienced the loss of actual money.
Cyber Security CSI aims to reveal how
common cyber attacks—infostealers,
phishing, spam, bad Android apps andscams—look as they’re unfolding. The goal
is to help you to avoid any serious losses byidentifying these cyber crimes, ideally as
they’re in progress.
Using an internet security solution, like
F-Secure Total, will ensure that you’ll avoid
just about all these threats. But no software
can yet prevent all human error. Only
preparation and education can guide us tobetter decisions. So, some insight into how
these threats unfold may help keep yourdevice from turning into a crime scene. Let’s
dig in.
* F-Secure Consumer Survey, December 2022, n=4000, ‘Simply Protected’1

CYBER SECURITY CSIWindows threats during 2022

F-Secured Your complete guide to online security in 2023

Downloader Trojan
Banking Trojan

CoinMiner
Source: F-Secure monitoring of prevalent threats.

How RedLine Stealer spread during 2022
The infostealer known as RedLine trended up throughout 2022 with the infections
racking up millions of stolen credentials.

01/11/2022

01/10/2022

01/09/2022

01/08/2022

01/07/2022

01/06/2022

01/05/2022

01/04/2022

RedLine Stealer
Trend line

Source: F-Secure telemetry tracking high-level visibility of infection hits.

13

Infostealer
Ransomware

01/03/2022

What is an infostealer?
Infostealers fit the definition of a trojan,
malware designed to mislead users by posing

1%

69%

01/02/2022

Information stealers, or infostealers, havebecome far and away the most common typeof malware faced by anyone running
Microsoft Windows PC. They suck up
hundreds of thousands, if not millions, ofcredentials, every month.
Nearly seven out of ten (69%) of the threatsobserved on Windows in 2022 were
infostealers. Since the beginning of thisdecade, the rise of infostealers has become
impossible to ignore, and increasingly, thedata this threat steals can be used to defeat
multi-factor authentication, including cookies
and system data.

1%
1%

01/01/2022

Infostealers28%

In 2022, consumers faced infostealers and similar threatsthat silently steal users’ information far more than any
other. Downloader Trojans that lead to malware to be
downloaded from external sources made up about
one out of four infections (28%). Ransomware, Banking
Trojans, and CoinMiner trailed while still racking up
significant infections.

CYBER SECURITY CSI

as legitimate software. Once a user has been
tricked into installing an infostealer, it will run
silently sucking up targeted data—including
credentials stored on the browser, logs of
instant messaging clients, and much more.
Other variants of information stealer cancapture screenshots, track keystrokes, andhelp criminals loot cryptocurrency wallets.
How to avoid infostealers
Utilize automated antivirus scans from aninternet security solution, like F-Secure Total,
on a regular basis. If an infection is found,change any passwords that may be stored inyour browser, along with the login andpassword credentials for any services you’ve
accessed through your PC. Always monitor
your online identity using quality identity theftprevention like F-Secure ID Protection, whichis included in F-Secure Total.

RedLine Stealer distribution
timeline for 2022
An overview of how RedLine Stealer spread during 2022
January
2022

Fake Omicron
stat counter

February
2022

Fake Windows
11 upgrade
installers

March
2022

Fake Valorantcheats on
YouTube

April
2022

Rig Exploit Kit

May
2022

Fake bot for
Binance NFT
Mystery Boxes
on YouTube

August2022

September
2022

October2022

November
2022

Fake ‘Cthulhu
World’
play-to-earn

Malvertising/Rig Exploit Kit

1 Criminals’ ability to profit off infostealers
begins and ends on the dark web, where
various versions of the threat are sold.

2 Criminals establish an alluring method
Fakeshareware
sites

Links from 2K
Games’ hacked YouTube
help desk
gaming videos

Google Search:‘Photoshop
crack keygen’

F-Secured Your complete guide to online security in 2023

designed to make victims click. An
unwitting victim initiates the download.
Once installed on the victim’s PC, thestealer collects the targeted information
and awaits further instructions from thecriminals.

Discord via PDF
Links
Fake MSI
Afterburner(Windows
gamers)Note: Actual samples on the campaigns may have been in the wild earlier than publication.

14

HOW THEY WORK

3 The stolen credentials are packaged withother victims’ data to be sold on the darkweb.

1. RedLine Stealer Advertisement (Source: cyberint.com)
2. Fake Windows upgrade website (Source: threatresearch)
3. Logs containing stolen data from RedLine victims (Source: socradar.io)

2

CYBER SECURITY CSIMost imitated social networking
platforms for phishing in 2022

7%

9%Phishing
Phishing remains a threat nearly everyone on
the internet must face. This is because thetactic works, especially when targeted at vast
numbers of potential victims. Phishing’s
continuing effectiveness comes from
criminals adapting their techniques to target
any platform or service that large numbers ofusers embrace. There’s also an ecosystemthat enables these attacks by providing
relevant tools and targets that criminals canfind, either through the dark web or on
legitimate platforms like GitHub.
Threat actors usually target victims’banking and credit card information, withstreaming services, social networks, andgaming sites being popular targets forphishers. As these platforms can containcredit card information or digital items, such
15

F-Secured Your complete guide to online security in 2023

1%

1%
1%

62%

Criminals love to use Meta’s Facebook, the world’s largest
social network, as a lure for phishing attacks. Meta’s
other apps, WhatsApp and Instagram, come in a distantsecond and third as the networks most likely to be imitated.
LinkedIn barely makes the top 20 of social networks by size
but ranks fourth as a phishing lure.

19%

Facebook, Inc.

WhatsAppInstagram

LinkedIn Corporation

VKontakte

Naver

Others

Source: F-Secure Threat Intelligence.

4%

Most imitated gaming platforms
for phishing in 2022

3% 3%

10%

37%

14%

Phishing scams have become increasingly effective
at targeting the billions of gamers around the world.
Phony emails attributed to Steam, the biggest desktop
gaming platform, make up the most common attacks.
Scams posing as coming from Roblox, a gaming platform
extraordinarily popular among internet users under theage of 16, rank second, followed by Garena, a free gaming
platform based in Singapore.
Steam

29%

RobloxAxie Infinity
Source: F-Secure Threat Intelligence.

GarenaG22 Online Gaming

Mobile Legends
OthersCYBER SECURITY CSIWhat to do
Change any phished password, along withany similar passwords. And if you’ve enteredcredit card details or financial information,
cancel the card or set up a fraud alert on theaccount. Unfortunately, you may not know if
you’ve fallen for a phishing scam, so use aservice like F-Secure ID Protection in F-Secure
Total, to monitor your data on the dark web.

Criminals spent 2022 exploiting the popularity of Netflix, the world’s largest streaming service, for phishingemails. The trend line up suggests these attacks were effective as they increased throughout the year.
3000
2500
2000
1500
1000

Spam emails
Trend line

500

F-Secured Your complete guide to online security in 2023

01/11/2022

01/10/2022

01/09/2022

01/08/2022

01/07/2022

01/06/2022

01/05/2022

01/04/2022

Source: Monthly spam volume based on F-Secure spam traps.

HOW IT WORKS

1 Using a wide variety oftools, criminals establish an
extremely realistic looking
phishing site.
Source: Alexandre Siviero.

16

01/03/2022

001/02/2022

What is phishing?
Phishing describes attacks that trick users outof private information or convince them toclick on links or attachments that lead tomalware. The attacks take place anywhere
people receive communication including
email, SMS, direct messages, or notifications.
These attacks rely on different tactics to build
trust with victims, which lure them into
handing out sensitive information and moneyor clicking on a bad link.

Frequency of phishing emails imitating Netflix

01/01/2022

as in-game currency, that can be sold on thedark web.

2 Criminals purchase breached,

leaked, or scraped data. Usingsome pretense that requires therecipient to offer private data,criminals approach the victims,
usually through email or SMS.

3 After entering data into the phishing site,
the victim is then redirected to the realversion of the site to camouflage thescam. The criminals collect the data inthe command-and-control channel of
their choice.

3

CYBER SECURITY CSI

Bad Android apps

Mobile threat infections over 24 months
When it comes to mobile malware, Android remains the most popular target for criminals. In 2022, the number of
infections targeting devices running Google’s mobile operating system trended up slightly as the year progressed.

01/11/2022

01/10/2022

01/09/2022

01/08/2022

01/07/2022

01/06/2022

01/05/2022

01/04/2022

01/03/2022

01/02/2022

01/01/2022

01/12/2021

01/11/2021

01/10/2021

01/09/2021

01/08/2021

01/07/2021

01/06/2021

01/05/2021

01/04/2021

01/03/2021

01/02/2021

Mobile infections detected
Trend line

01/01/2021

Infections targeting Android devices
increased between 2021 and 2022. More thanhalf of these threats come from a category of
bad apps known as PUA (potentiallyunwanted apps), followed by malware, whichmake up nearly one-third (32%) of all mobile
infections.
The top Android infection overall falls under
the category privacy risk tool apps. Most
examples of this infection are unofficial buildsof WhatsApp, which function like the official
version while offering additional features,such as more themes and emojis. These apps
were mostly not malicious, but they may
include unwanted tracking and evenmalicious modules. In 2022, Triada—a trojan
that has been targeting Android devices sinceat least 2016—was found inside these

Source: F-Secure infection hits.

17

F-Secured Your complete guide to online security in 2023

CYBER SECURITY CSI

unofficial builds, using these bad apps as alaunching point for more attacks.
What is a bad app?
The line between potentially unwanted apps
and malware can be blurry. However,malicious apps cross the line by taking overusers’ accounts. Actual Android malware
includes banking trojans, such as SharkBot,
which steals credentials. Typically, thesethreats are found on third-party marketplaces
or other sites outside of the Google Play Store.
But recently, threats including SharkBot haveappeared in the official Play Store.
What to do if you suspect foul play
If you think an app is tracking you or contains
malware, delete it—especially if it didn’t comevia the official store. To do this, open Settingsin Android. Choose ‘Apps & notifications’ and‘See all apps’. Select what to uninstall andfollow the instructions. If it doesn’t work, hold
‘Power Off’ for a few seconds to restart in ‘Safe
Mode’, and then try again.
18

F-Secured Your complete guide to online security in 2023

HOW THEY WORK

32%

2%
66%

1 Inside SnapTube, a popular free Android

Mobile threat type distribution

video downloading app, a user sees an ad
for YoWhatsApp, an unofficial version of
WhatsApp.

Potentially unwanted apps, which include
monitoring software that can be installed without
the user’s knowledge, constitute the majority ofmobile threats detected. However, nearly one out of
three mobile threats detected (32%) can be clearly
defined as malware that aims to steal private data.
Files that test device security make up a small but
noticeable slice of the threats observed.
Potentially unwanted apps
MalwareOther
Source: F-Secure infection hits.

2 Once installed app functions just like theofficial WhatsApp. Unfortunately, theinstallation also grants the Triada trojan
the same permissions as the app.
Criminals can now upgrade users topremium subscriptions without the users’permission. And their WhatsApp accounts
are at risk of being hijacked and used forcarrying out other attacks.

4
Spam
Spam has become an annoyance thatgenerally gets buried in the junk folder of ouremail boxes, as both the filters and laws
attempting to reduce this scourge have
improved. Still billions of pieces of spam aresent out every day, and it remains a toolcriminals utilize to spread both scams andmalware.
‘Free Gift’ scams delivered through spam
proved to be popular throughout 2022. Thesescams weaponize names of popular brands,
including Amazon, Apple, McDonald’s,
Costco, and major airlines. They lure users to a
website with the promise of free ‘gift cards’
and other prizes. All the victims must do is
answer a survey and offer information, which
may include personal data and credit card
information. The data stolen is then used by
19

F-Secured Your complete guide to online security in 2023

CYBER SECURITY CSICYBER SECURITY CSI

criminals for financial gain, which includes
fraud and identity theft.
What is spam
Spam is any unwanted, unsolicited bulk digitalcommunication—including email, messages,
and social media posts. The goal of spam isgenerally financial gain; tactics range fromattempts to sell products or services to mass
cyber crime campaigns spreading phishingscams or malware.
What to do if hit by spam scammers
Stop any transaction as soon as you feel it’ssuspicious. If you’ve already made a payment,
contact the provider that carried out thetransaction—in this case PayPal—to cancel orcontest the payment. Credit card companies
make it relatively easy to reverse payments,
which is a good reason to use credit cards forall online payments. Internet security that
includes Browsing Protection, like F-Secure
Total, will save you from scams by blocking
malicious sites.

HOW IT WORKS

1 The victim receives a solicitation that offers aluxury bag at an unbelievable price.

F-Secured Your complete guide to online security in 2023

more incredible offers.

3 For the shipping address, any text works in all
the fields.

4 The scam then guides victims to select ‘For friends

and family’. Notably, PayPal’s fraud protection does
not cover personal payments.

5 After sending a payment to someone named ‘James’,
the victim receives nothing.

20

2 The link leads to a bogus yet convincing website with5

CYBER SECURITY CSI

Scams

21

F-Secured Your complete guide to online security in 2023

Attempts to commit fraud using scams related to Ukraine spiked immediately following
the invasion of the country by Russian forces. Since March 2022, these scams have varied
up and down as the year progressed, but continue to be quite common.
2500
2000
1500
1000
500

01/12/2022

01/11/2022

01/10/2022

01/09/2022

01/08/2022

01/07/2022

01/06/2022

01/05/2022

01/04/2022

01/03/2022

001/02/2022

What is a scam
The US Federal Trade Commission (FTC)
tracks reports from victims around the world.

Email scams exploiting the Ukraine crisis

01/01/2022

Scams are not unique to the internet, but theinternet is uniquely useful to scammers, who
can target victims anywhere. Using social
engineering that encourages victims tobelieve wishes can come true, scammers
provoke irrational behavior. Even the bestinternet security in the world cannot preventyou from sending money to a stranger you
met online, if you believe doing so is in yourbest interests.
Scammers are ruthless in their willingness
to use anything to manipulate victims.
Throughout 2022, criminals exploited theinvasion of Ukraine for numerous of scams,
often exploiting the worst miseries of the war.

These examples
illustrate how
awful typography
can be a sign ofcyber scams.

Source: Monthly spam volume based on F-Secure spam traps.

CYBER SECURITY CSI

The most prevalent scams fall into thecategories of online shopping, investment,
business impostors, vacation and travel, andromance. And the emergence of
cryptocurrency, which is far more difficult totrack than traditional financial transactions,has driven online scams to new levels.

Fraud increase since 2017
Reports about fraud originating on social media
soared over five years. 2021 total reported losses
were about 18 times what they were in 2017,
and the number of people who reported losing
money in 2021 grew to 19 times higher than thosereports in 2017.
96K

What to do if you fall for a scamContact law enforcement (if safe to do so) andany bank, wire transfer company, or credit
card provider used to send the scammer
money as soon as possible, no matter how
embarrassed you may be. If you sent
cryptocurrency, reversing the payment may
not be possible. Still, you should report the
fraud to the company you used for thetransaction. You should also monitor youridentity using a service like F-Secure ID
Protection, which is included in F-Secure Total.

1 ‘Pig butchering’ scams begin with aconvincing, alluring false identity. The
scam gets its name from the practice of
fattening a pig before slaughter.

46K

15K
10K

2 The scammer approaches, often by

5K
$42M

$78M

$105M

$258M

$770M

2017

2018

2019

2020

2021

Figures based on fraud reports sent directly to the FTC, indicating a monetary loss andidentifying social media as the method of contact.

22

F-Secured Your complete guide to online security in 2023

HOW THEY WORK

pretending to mistake the victim for an oldfriend. Gradually, the topic of investments
comes up. The scammer then convinces
the victim to get the app MetaTrader andput money in a ‘brokerage’ account.

MASTER YOUR PASSWORDS

Master yourpasswords
Every month millions of people have their passwords stolen.
Here we explain how to keep your passwords secure.

O

n a weekly basis you’re likely
using around 10 different
accounts, but did you know thaton average each of us alreadyhas close to 100 online accounts? Most of us
can’t even name all sites we’ve beencreating accounts for – think about all
webstores you’ve made a single purchasefrom, or perhaps those mobile apps thatforce an account creation in order tofunction. Now, if we don’t even remember all
the services we’ve signed up for, how could
we remember all the required passwords?

Multiple weak passwords

To solve this, people tend to do one or both of
the following: they either reuse a handful ofpasswords (or just one) across all services,or they make some slight but obvious
alteration to their common password (like‘P@sswordFB’ for Facebook,
23

F-Secured Your complete guide to online security in 2023

‘P@sswordIG’ for Instagram, and so forth),
resulting in multiple weak passwords.
The issue with both is the same: credential
stuffing. In a nutshell, it’s likely that your login
details have leaked through at least one
data breach, and now criminals are tryingthat one leaked email address + password
combination to access a wide range of
online services. So, as the name implies,
they’re ‘stuffing’ your credentials in manydifferent locks, and hoping that they open as
many as possible. This is a very popular
technique, because it simply works due toreused and weak passwords. By accessing
just one of your passwords through a data
breach, criminals can now take over severalof your accounts. Similarly, if, for example,
Facebook login credentials have been
leaked, it doesn’t take a criminal
mastermind to look for all mentions of ‘FB’ inpasswords, and automatically replace them

MASTER YOUR PASSWORDS

with ‘IG’, and then test those credentials in
Instagram.
To combat the impossible task ofremembering all passwords, many people
have begun to store their credentials in their
web browsers. In fact, in a recent survey
75% of respondents answered they save atleast some of their passwords in their web
browser. This is a step in the right direction,but, unfortunately, the cyber criminals havenoticed this as well. In 2022, the ‘infostealer’malware type gained popularity among
cyber criminals, and it was often specificallyused to steal login credentials stored inbrowsers. For example, in December 2022
alone, F-Secure saw 23 million credentials
stolen with malware such as RedLine
Stealer, Raccoon Stealer and Vidar Stealer.

Password no-nos

Sometimes passphrases have beensuggested as a replacement for traditional
passwords. Often passphrases consist of
3-4 random words written together, forminga ‘password’ that’s relatively easy toremember and almost always longer thanits traditional counterparts. And when it
comes to passwords, bigger is better.
However, when there are hundreds ofpassphrases to memorize, the system
becomes just as impossible for us humans
to remember and keep track of.
Passphrases gained their 15 minutes of
24

F-Secured Your complete guide to online security in 2023

“And this is where
password managers
come into play.”fame several years ago when a popular
webcomic XKCD illustrated how thepassphrase ‘correct horse battery staple’ issuperior to the password ‘Tr0ub4dor&3’.
While this is technically correct, we’re willing
to bet that a lot of people started using‘correcthorsebatterystaple’ as theirpassword, which brings us into another big
password no-no: common passwords.
Using massive lists of common passwords,
criminals try them one by one to gain
access to accounts. This technique isreferred to as ‘dictionary attack’, as it often
can include a literal dictionary’s worth ofwords that the automated attack goes
through to see if one of them has been usedas the password for the account thecriminal is trying to access.
So, let’s summarize: we all have a hundredor more online accounts. For each of them
we should have a password that is strong,
and—most importantly—unique, meaning

we only use each password to log in to asingle service. Some people even advise
that: ‘a good password is one you can’t
remember’. Which poses quite aconundrum.
However, modern problems require
modern solutions, and this is where
password managers come into play. A
password manager is an application that
not only generates strong and long
passwords for you, but it also stores themsecurely. To access your vault of passwords,
you only need to remember one ‘masterpassword’. This, of course, needs to bestrong and unique as well, but we’re allmuch better equipped to remember just one
perfect password than a hundred or more ofthem. With F-Secure Total, your passwords
are monitored, you will be alerted ofbreaches should they occur, and you cangenerate and manage strong passwords forevery online account that you have.

EXPERT TIP“Most online services
nowadays offer two-factor
authentication (2FA), which
increases the security of youraccount. If the 2FA is available,
do consider turning it on. With
this extra layer of security, even
if someone steals yourpassword, they still only have
half of the ‘key’ needed to get
into your account.”
Sarogini Muniyandi, Manager, ThreatProtection EngineeringTwo-factor authentication(2FA) works by adding an extra
layer of security to online
accounts beyond yourusername and password,
requiring an extra login
credential (such as a one-time
passcode, sent to your phone
via SMS). By utlizing two formsof identification, accessed via athird-party authenticator (TPA)or separate device, 99.9% ofautomated attacks areprevented (according 2019research from Microsoft).

PHISHING SCAMS

5 killerphishing
scams
Phishing is one of the mostprofitable forms of activity
for cyber criminals – andone of the biggest threats foronline users. In this article
we will look at examples ofphishing from 2022.

25

F-Secured Your complete guide to online security in 2023

Phishing overview:
Phishing refers to the act oftricking users into handing
over personal details or
money to criminals.
Phishing is used to steal login
credentials and personal
details, which the criminals
can then use for accounttakeover and identity theft.
Criminals can also sellhijacked accounts, or theircontents, use theseaccounts themselves, andforce victims into paying theattacker. The end goal for
criminals is predominantly to
get money. The information
stolen with phishing is just ameans to an end.

1

PHISHING SCAMSSocial network
account phishing
Based on our data (see page 15), Facebook,
WhatsApp, Instagram, and LinkedIn were the
top social media platforms targeted withphishing in 2022. Criminals were after social
media credentials, personal information, andfinancial data.
How to spot the attack: Comes via friend
request and messages from unknown profiles
promoting links to web pages.
How to avoid it: Run safe browsing protection.
Don’t accept friend requests from unknown
profiles. Set an alternative email or phone
number for retrieving your account. Use
unique passwords and two-factor
authentication.
26

F-Secured Your complete guide to online security in 2023

2

PHISHING SCAMS

Phishing in the name of Netflix
A brand you know gets your attention easierthan an unknown one. That’s why criminals
mask their phishing to resemble well-known
brands. In 2022, Netflix was one of the brands
that were most used for email
phishing campaigns worldwide(see page 16).
These emails told the receiverthat their automatic payment
was declined. To fix it, thevictims were lured to updatebilling information through a link
which led to a fake login page.
Once the victim submitted theirlogin details, the attackers wereable to take over the account.

27

F-Secured Your complete guide to online security in 2023

How to spot the attack: An email from Netflix
with a “your payment was denied” message,
and a link for fixing it. Inspect the sender field
to spot typos and suspicious email addresses.
How to avoid it: Don’t open thelink. If you are unsure, sign into
your account through an app orbrowser and check yourpayment status.

In the phishingmessage opposite,
warning signs
include suspicious
sender info

3

PHISHING SCAMSContemporary
topics: Ukraine
Phishing campaigns often utilize
contemporary topics. It’s easier to get
attention when people are already interested
in the topic. Therefore, the war in Ukraine wasa major topic used in phishing in 2022 (seepage 21).
Some of these campaigns preyed on
people’s will to help. This kind of phishing was
spread via email and in the name of charity
organizations, like the Red Cross. The victims
were lured to “donate” cryptocurrency to help
Ukrainians.
Many campaigns also lured victims tocontact ‘hot Ukrainian girls’ looking for love.
Believing they were conversing with Ukrainian
women, the victims needed to create a paid
28

F-Secured Your complete guide to online security in 2023

profile on a dating platform. The victims
regularly needed to pay more to keep on
chatting or to unlock more photos.
How to spot the attack: Emails promoting
help for Ukraine by paying in cryptocurrency.
Alternatively, emails promoting paid datingsites with ‘Hot Ukrainian girls’.
How to avoid it: Cryptocurrency payment is a
red flag. Trust only well-known charities. Use
payment information stated only in theirwebsite. People seeking real love will notcontact you through paid dating sites.

4

PHISHING SCAMS

Smishing ‘Hi Mum’ scams
The ‘Hi Mum’ scam is an example of smishing(phishing involving phone messaging). The
attack begins with a WhatsApp message
from an unknown phone number, starting withthe words ‘Hi Mum’ or ‘Hi Dad’. However, inthese cases the sender is a scammer posing
as the receivers’ adult child.
The scammer told the receiver that thechild’s phone has broken down and that this istheir new phone number. The attacker thenasks for money to pay an urgent bill or to buy a
new phone; they say they need money
because they can’t access their bank without
the old phone; or some other explanation.
It can be difficult for parents to thinkrationally when their child needs help. This iswhat the scammers were aiming for. And theysucceed: many victims from the UK, Australia
29

F-Secured Your complete guide to online security in 2023

and New Zealand reported losing thousandsof pounds or dollars to scammers.
How to spot the attack: Look out for
WhatsApp or SMS messages from unknown
numbers claiming to be family members.
How to avoid it: Call the old number or send
them a message on social media to check if
it’s real. Don’t send money to people
contacting you from unknown numbers.

Examplesof ‘Hi Mum’
messages
Source:www.dailymail.co.uk

5

PHISHING SCAMS

Gaming-related phishing scams
There are billions of gamers around the world,and billions of gaming accounts. In addition topersonal details, these accounts include
games and downloadable content, like skins,
weapons, and other virtual items, which canbe very valuable. This makes gamers a major
target for criminals.
Based on our data (see page 15), Steam andRoblox were the top gaming platforms
targeted by cybercriminals.
In 2022, attackers used a technique called‘voting scams’ to steal Steam accounts. The
attack starts in a Steam or a Discord channel
with a message appearing to be from a friend
asking the victim to follow a link to ‘vote for
their team’ The link directs to a phishing page.
Once they click on it, their Steam accountgoes to the attacker.
30

F-Secured Your complete guide to online security in 2023

Another new technique discovered in 2022
is called a browser-in-the-browser attack. The
technique uses a pop-up window within thebrowser to mimic a login website and to hijack
Steam accounts.
In attacks targeting Roblox users, ‘Free
Robux’ scams were popular. The attackers
often used YouTube videos with a link to entice
kids to get free Robux, the in-game currency
used to buy items. Following the link led
viewers to phishing sites where criminals
collected login information that enabled themto take over users’ accounts.
Phishers also hijacked Roblox accounts
with fake User Ads, offering free items, Robux,
Premium membership, or accessories.
Clicking the ads led gamers to phishing pages
where the users were asked to enter theirusername and password to claim the items.
How to spot the attack: Messages asking tovote for a team. Any unexpected message
with a link is suspicious. Alternatively, ads orlinks promoting any free content that isnormally paid.
How to avoid it: Run safe browsing protection.
Don’t enter your login details outside thatparticular service. Avoid free stuff, as it is often
just a trick. Educate kids about phishing andscams.

Malicious
Roblox ad
used forphishing
Source: Roblox ForumOPINION

How cyber security
is getting personalP
Laura Kankaala

icture a cyber criminal. Maybe an image of aperson in black hoodie pops into your head. They
are hacking into corporate systems or bankaccounts of private individuals. That someone is adistant threat, taking advantage of flaws in systems andhuman nature for their profit. But what if the criminal issomeone different? Someone closer to home?

Threat Intelligence Lead F-Secure

Complex relationship dynamics

Laura Kankaala is Threat Intelligence
Lead at F-Secure. Kankaala studied at
Finland’s Turku University of Applied
Sciences before working as a security
consultant for a number of companies
including F-Secure. Kankaala is an active
columnist, speaker, and podcaster, andshe is a regular contributor to F-Alert,
F-Secure’s monthly threat report.

31

From stalkerware to shoulder surfing, F-Secure’s Laura Kankaala
reveals how relationship dynamics are shaping cyber security.

F-Secured Your complete guide to online security in 2023

Modern technology does not necessarily create newproblems, but it extrapolates existing ones. Bullying hastaken a foothold in online spaces from the Internet’s very
beginnings, only getting worse as the usage of social media
made online social interactions more mainstream.
And you don’t even have to be a celebrity to be publicly
shamed on TikTok for something you’ve said or done. It
doesn’t even matter if your actions are taken out of context.
Complex relationship dynamics now exist online. Not only
friendships, but even finding a partner now happens via
apps. And the internet plays an increasingly more importantrole in cultivating romantic long or short distance

relationships between people—sometimes between people
who have never met in real life.
In these examples, we are exposing ourselves to new kindsof tracking and privacy related concerns, that do not only
stem from the imaginary black-hoodie criminal mindset. We
are subject to online stalking and unsolicited messaging.
Our intimate messages or pictures may be screenshotted
and used against us. Someone may even read our private
conversations without our permission.
And our personal digital space can be invaded with little tono technical expertise. With ‘Shoulder surfing’—i.e. stealing
someone’s passcode by discreetly observing them while
they unlock their phone—being an ever-present threat.

The persistent threat of stalkerware

Of course, there is technology that is made for, or at leastcan be utilized for stalking or violating someone’s privacy.
An example of such technology is ‘stalkerware’—an app orsoftware that can be installed on someone’s device, whichthen grants wide access to it, including photos, messages,
location and so forth. Installation and guidance of how toOPINION

use stalkerware is typically well documented, so it reallydoesn’t take a Hollywood hacker to be able to use one
against us.
Android devices are the easiest ones to monitor, withdifferent types of stalkerware apps available, due to the way
its permission model is designed. Upon installation, theperpetrator can choose to give very large privileges for theapp, meaning they can constantly track what’s happening
on the screen. And based on our detections at F-Secure, we
can see that installation of different stalkerware app
families are now a persistent threat.
One of the telltale signs of stalkerware app installation on
your phone is that the battery seems to run out very fast andthe phone feels warm. This is because the stalkerware apps
are constantly keeping tabs on the location of the device,
which consumes a lot of battery power. You can also checkyour phone with Android antivirus tools.

Changing relationship dynamics

But, as I described above, usage of malicious software suchas stalkerware is not always needed to violate our privacy.
People and relationship dynamics change. And you may

lose touch with someone you previously trusted.
Maybe you’ve shared a Netflix password with someone
you used to date, and you happen to reuse the same
password in Instagram. Or perhaps you’ve given access toyour email account so someone can take care of handlingsome business for you.
In all fairness, though, you should not stop trusting people
because things may turn sour at some point in the future. At
the same time, you should only do what feels right, and notshare information or pictures that make you feel
uncomfortable. And you should practice a sufficient level of
security to protect yourself—use unique and strong
passwords; change your device passcode, in case an
untrusted partner knows it; and avoid sharing passwords.
Conventionally, information security—or cyber security—ismostly used in reference to defending people ororganizations from crime. But when much our lives are
spent online, the need for ‘cyber security’ becomes
nuanced, and is more than just a means of keeping us safe
from online burglars. In the end, we all need cyber security
in our lives. Because it’s not just about avoiding the criminal
hackers, it’s about being digitally independent.

“Stalkerware apps areconstantly keeping tabs on
the location of the device.”
32

F-Secured Your complete guide to online security in 2023

TRENDS AND PREDICTIONS

12 trends andpredictionsfor 2023

In this special report, leading experts within F-Secureshare their cyber security trends and predictions.

Cyber security is a game of cat
and mouse. Every year the threat
landscape evolves, based on
numerous factors, such as theincreasing use of different devices andchanging social behavior, like the increasein people working from home. And 2023 will
be no different.
Phishing and smishing scams will continue
to evolve. In a survey of 4,000 respondents(aged over 25 years) at the end of 2022,
F-Secure found that 31% of consumers had
been affected by cyber crime in 2022. In thesame survey, 43% of respondents said thatthey had received phishing or smishingmessages impersonating their bank orinsurance company over the last 12 months.
And with more than 20 connected devices
in the average home (22 per US residence in

33

F-Secured Your complete guide to online security in 2023

2022, according to Deloitte), and homebased working driving a need for stronger
security, as employees access moresentitive data from home, the threats weface will continue to evolve.
Put simply, it’s hard stay aheadof the curve. But at F-Secure ourteam of threat advisors,researchers, productmanagers, and analysts
tracks the latest
trends andemerging threats,
enabling you to stayonce step ahead ofcyber criminals. And
here they reveal theirpredictions for 2023
and beyond.

1

CONSUMER IOT
ENTERINGKILOWATT LEVELS
Mika Lehtinen
Research Collaboration

The Russian military invasion of Ukraine
triggered an energy crisis in Europe. Thishas made energy prices reach previously
unseen levels, and caused a spike indemand for smart heating solutions,enabling consumers to control andoptimize their energy bills. The smart
heating solutions are essentially remotelycontrolled, consumer IoT systems in thekilowatts power range. This is a clear
upward shift from the smart bulbs,
cameras and other small, connected
devices popular in smart homes.
Commercial energy solutions are being
rushed to the market as demand is high.
And while smart energy solutions are avery positive development for cost control,
not to mention countering climate change,
it is likely that the cyber security and safety
aspects of the solutions are not reallyconsidered when solving the acuteproblem at hand. This opens new kinds ofrisk for the connected home, ranging fromelectrical safety to fire hazards if systems
are compromised, causing them tomalfunction.

TRENDS AND PREDICTIONS

2ACCOUNT TAKEOVER
ATTACKS SCALE, MAKINGEVERYONE A TARGET
Joel Latto
Threat Advisor

It’s not out of the realm of possibility that
we’ll see criminals taking the same
extortion pattern that has been used withransomware, adapting it to accounttakeovers. After gaining access to youraccount (e.g., your social media profile,email inbox, cloud storage, etc.), bad actors
could then sell you the “service” of getting it
back. Alternatively, if users refused to pay,they might then proceed to publish yourprivate information and delete youraccount.
This hasn’t been viable in thepast, but if criminals can
automate most of theseinteractions (which iscertainly something they
always try to do), then scaling
such “low level” crime might
become commonplace.
They already haveaccess to billions ofstolen login details
on the dark web,which could be
used in suchattacks.

34

F-Secured Your complete guide to online security in 2023

3

GAMERS WILL FACE
INCREASING THREATSMaria Patricia Revilla-Dacuno
Senior Threat Researcher

Cyber criminals will continue to target information thatcan be used for financial gain. This can be in the form of
more sophisticated infostealing trojans, or by targetingorganizations. More cyber crimes will be coming as data
breaches continue. Personal information, billing data,
health records, or data of a sensitive nature hashigh value in the dark market. Attackers
can use such data for taking overaccounts, stealing money from bankaccounts, and identity theft. And
attackers can create fakeprofiles and commit more crimes
such as scams and phishing.
Scam and phishing through email,text messages, social media andgaming platforms will continue, as these
are channels that are part of consumers
everyday life.
According to Statista, gaming accounts
have the biggest share of market revenues
in the consistent growth of global digitalmarket—with an estimate of one billion
online gamers worldwide. This number ofusers is projected to exceed 1.3 billion in
the year 2025. With this growing numberof users, we can expect that cybercriminals will continue to target theseplatforms for scams and phishing.

4

TECHNO FUTURISTGRIFTERS
Fennel Aurora
Product Management
Community Lead

Many consumer software and devicecompanies, along with uncritical media
repeating their claims unchecked, havegone through multiple hype cycles for
scammy technologies built on theft, mass
harm, and human-rights violations, while
never providing anything like what thetechno futurists are promising. Examples
include blockchain, metaverse, manydifferent forms of luxury surveillance, anddigital phrenology, and almost everythingthat is advertised as artificial intelligence,
while being neither artificial nor intelligent(e.g. ChatGPT). These technologies, or atleast the claims of these technologies,
continue to be used as the smoke andmirrors in a vast array of scams
and grifts, and this trend isaccelerating. If companies andmedia tell you something is going
to be the next big technology,
magically solving everything, heavy
skepticism is required. These claims
have never been born out by reality,
but the harms experts warn aboutfrom the start pollute our every digital
moment.

TRENDS AND PREDICTIONS

5

PHISHING, SCAMMING,
AND HOW AI CHANGESTHE THREAT LANDSCAPE
Abdullah-Al Mazed
Senior Technical Product

You have probably seen some phishingemail or SMS where you could instantly
detect the attack, because of agrammatical or spelling mistake. Sadly,
thanks to developments in the world oflarge language models (LLMs), those days
will be a thing of the past. ChatGPT
demonstrates how far natural language
processing (NLP) has already gone, andhow easy it is to write a very convincing
mail or blog post with a simple prompt anda handful of keywords. Phishing attacks
will only get more sophisticated with AI,
and it will be an automated multi-stepprocess, where the first communication
will have no links to a phishing page, and norequest to do anything specific, beyond
initiating a conversation that will develop
over time.

35

F-Secured Your complete guide to online security in 2023

“Phishing attacks
will only get moresophisticated with AI.”6

OLD SCAMS CONTINUE TO TARGETHUMAN VULNERABILITIESCarl Blomqvist
Senior Technical Product Manager

Have you or your relative ever gotten a call from who
claimed to be from Microsoft or Amazon? Although we getmore knowledgeable and cautious about phone
scammers, they can find us in the most susceptible,
sensitive moments, and push on our guilt and humanity inorder to steal money from us. Unfortunately, scammers’
profits are still high.
Working in the area of cyber security we are used todevices and software having vulnerabilities. However,
it is important to keep in mind that we humans havethem as well. Criminals don’t always use viruses ormalicious applications. They can also use psychology andour good faith to harm us.
The good news is that F-Secure has users covered in theirmost vulnerable moments. We keep an eye on the various
hazardous experiences that users may face, and find thetechniques to prevent them, including protection against
scammers.

7

DATA BREACHESCONTINUE,
BUT VERIFYINGAUTHENTICITY IS HARD
Calvin Gan
Senior Manager, Protection
Strategy

Data breaches have been fuelingheadlines in 2022 and this will continue
in 2023. Verifying the legitimacy andauthenticity of these leaks will become
harder, as information released is often
saturated with data from the same
database, sometimes packaged
differently to gain hype, thus giving
advantage to new threat actors, utilizing
this information for short-lived extortion.
The after effect of this could potentiallybe:Users receiving an increase of genericspam emails from threat actors trying
to quickly capitalize on data leaks
User fatigue in the wake of multiple
breach notifications, where they may
choose not to take any further action
A rise of fake breach notification
websites or services in an attempt for
information harvesting or social
engineering.

TRENDS AND PREDICTIONS

8

TRUST ANDONLINESHOPPING
Ekaterina Makarova
Senior Quality Engineer

We need to be mindful while doing suchbasic things as online shopping. It has
always been a minefield to differentiate
between official websites that sell goods,
and those who masquerade as official andtrusted ecommerce operators. We cannot
believe our eyes anymore, and online
reviews can be easily contaminated.
Criminals lure us onto websites thatpromise gold but give us financial loss or,even worse, ID theft.
On the positive side, F-secure’s
cyber security experts areworking on ways to makeonline shopping a more
pleasant and safer
experience. As always it allcomes down to choosing
a trusted security
product, enabling
you to stay securedespite cybercriminals’
persistence andcreativity.

36

F-Secured Your complete guide to online security in 2023

9

SPONSORED CYBERCRIMINALSTARGETING CRITICAL FACILITIESNadzreen Aqil Mohd Yusof
Junior Threat Researcher

The unstable political situation around the globe is
expected to increase the number of sponsored cybercriminals—with strategic and specific goals—targetingcritical facilities.
In 2010, Stuxnet highlighted the capability of cyber crime
to damage a country’s nuclear infrastructure, which
ultimately costs money, time, and reputation. The use oftechnology in critical industries such as nuclear power
provides sponsored cyber criminals with more possibilities
to try to target a country’s essential facilities.
And companies linked to critical industries such asenergy, food, defense, and health are likely to become themain target of sponsored, threat actors. Any employees,
contractors, or family members should be vigilant, as cybercriminals looking to gain access to a network, or evenphysical facilities, may target them.

“This opens
the door for
attackers.”
10

THREATSHIDING IN
PLAIN SIGHT
Khalid Alnajjar
Threat Data
Researcher

With the recent advances in machinelearning, neural models can becompressed, shipped and executed on
the client side (e.g., via a browser ormobile app). Malware and personalizedphishing pages can be embedded insuch neural models, where they would
get activated only when a certain input ispassed; otherwise, a legitimate output isreturned. Additionally, neural models
could learn to produce new variations ofa given code while maintaining thefunctionalities. This opens the door for
attackers to rapidly generate unseen
attacks and camouflage them.

TRENDS AND PREDICTIONS11

IOTDEVICESTom Gaffney
Director of Business
Development, Network Services

Consumers are purchasing more and more
IoT goods, with more innovation in this spacethan with traditional devices like mobiles,
tablets and laptops. And global IoT devices
are expected to grow to more than 29 billion
by 2030, according to Statista. With thisgrowing number, together with new IoT
malware code publicly available, we can
expect that more IoT threats will be
developed.
As a relatively nascent market, many of
the IoT goods we’ve seen developed misssecurity and privacy by design. This is
improving with governments and agencies,
such as the EU, driving a standards
approach, but it will take years before
security is commonplace. In the meantime,since the global attack by Mirai in 2016,
cyber criminals have seen that IoT devices
are now a profitable attack vector. And with
IoT devices different security solutions are
required to protect businesses andconsumers.
37

F-Secured Your complete guide to online security in 2023

“IoT devices are
now a profitableattack vector.”
12

CRAFTY ANDINNOVATIVEATTACK
VECTORS
Amit Tambe
ThreatResearcher

Attackers will continue to be crafty and innovative whendevising tactics to trick users into infecting themselves.
YouTube video descriptions could be the most lucrative,
especially videos about gaming or pirating software.
Both tend to attract unsuspecting victims, who—by thenature of what they are searching for—havequestionable scruples, and who then become easy prey
to attackers’ tactics. In addition to YouTube, other crowd
attracters such as Telegram, Discord, etc. will continue
to be the first step for attackers wanting to spread theirmalware.

xxxxxxxxxxxxx

About F-Secure
F-Secure makes every digital moment moresecure, for everyone. We deliver brilliantly
simple, frictionless security experiences thatmake life easier for the tens of millions of people
we protect and our 170 partners.
For more than 30 years, we’ve led the cybersecurity industry, inspired by a pioneering spiritborn out of a shared commitment to do better byworking together.
For more information visit F-Secure today.