# Phishing Attacks Survey: Types, Vectors, and Technical Approaches
## 7 Discussion of Current Challenges and Trends in Phishing Attacks  
Phishing attacks are one of the most prevalent threats to the whole internet community from individual users to large corporations and even service providers. As has been discussed above, there are current methods for detection and prevention of phishing techniques, but there is yet to be a comprehensive solution to this phishing problem [81]. Due to the huge variety of techniques and the constant introductions of new vectors, developing detection and prevention methods is a challenge that will not be simplified or eradicated with the passage of time, as shown by October of 2019 having by far the highest phishing rates in the last three years, and the mean number of phishing websites steadily increasing throughout 2019. The trend for the top targets for phishing attacks remains web-mail and software-as-a-service, with these making up over 30% of detected attacks, followed by payment sectorsand financial institutions in 2020. There has also been a 20% increase in social media attacks since the start of 2020 [7; 8; 82]. One of the challenges faced by those trying to combat phishing is distinguishing phishing websites from legitimate sites. In recent years, the use of SSL by phishers to make their site seem more genuine has been growing and is now up to 78% of all detected phishing sites [83]. Before, even if a target was directed to a phishing site, most modern browsers display a warning if the connection to the site is not secure (HTTP rather than HTPPS) or is using a suspicious certificate. However, with the increasing use of SSL, it makes it significantly easier for non-tech savvy targets to be fooled by these fake sites and the use of SSL on phishing apps for mobile devices makes their detection much harder. Some antivirus software now provide browser add-ons to assess the reputation of a site and display warnings if the site is found to be disreputable. However, this system does rely on the community rating these sites, a system that could be manipulated with enough effort, but it should identify simple phishing sites with ease. These will be effective for businesses and users who are capable of installing them, or even knowing to install them, but as shown above in Section 3.3.1, the primary targets of phishing attacks are the older generations who are less likely to know about these technologies. Virtual private networks (VPN) are becoming more commonplace in recent years and whilst often advertised for their ability to change users' location, they do provide a layer of security for some types of phishing attacks, especially wiphishing. However, this type of protection is one of the least-used protective measures as many users find them complicated to use, especially in older generations [84]. Anti-malware software is also important for some types of phishing where malware is installed (such as drive-by-download). However, whilst many are aware and do have these installed on computers (82%), adoption of this on mobile devices is significantly lower (around 37%) [84]. This is a major issue; as outlined above, mobile devices can be targets for phishing attacks just as easily as email or any other vector. Detection of desktop phishing attacks is different from detection of mobile phishing attacks due to the difference in architectures [85]. Furthermore, the accuracy of a mobile phishing attack is a vital issue among researchers in this field. Some anti-phishing solutions for mobile devices have been implemented; but still, there is still a lack of a comprehensive solution for this issue [83]. Mobile devices are also important to secure for their secondary feature as a method of two-factor authentication, be it using an authenticator app or a text message, which many sites and services now insist on, or highly recommend.