Big Spike in Work-from-Home Phishing Email

Phishing email attacks related to working from home are rising amid the continuing COVID-19 pandemic, according to KnowBe4 research.

KnowBe4’s Q4 2020 top-clicked phishing report reveals the top 10 general email subjects. It also includes the top 10 in-the-wild email subject lines.

In-the-wild email subject lines represent actual emails that users received and reported to their IT departments as suspicious.

The KnowBe4 research shows work-related email subjects such as corporate policy changes are becoming more popular. That’s because the pandemic continues to keep more people working from home.

Tony Jennings is KnowBe4’s senior vice president of international and global channel sales.

KnowBe4’s Tony Jennings

“One surprising item from the report focuses on the social media click rates where people at work are falling victim to social media inquiries on their work emails,” he said. “Social media, unless for business, should not be mixed between personal and work accounts. If people are getting emails for LinkedIn, Facebook, Twitter to their work accounts, it’s a strong recommendation to shift them to personal accounts. If users still receive social media emails to their work accounts, they can quickly dismiss them, as they are phishing attacks.”

General Email Subjects

According to the KnowBe4 research, the top 10 general email subjects are:

Lack of security awareness training is leading employees to fall for these phishing email schemes, Jennings said.

“On average, organizations spend less than 3% of their IT budgets on human training or social awareness training,” he said. “Technology is often an organization’s go-to defense to protect against malicious emails. But the technology systems still allow about 10% of emails through to end users.”

In-the-Wild Email Subjects

When investigating “in-the-wild” email subject lines, KnowBe4 found the most common throughout the fourth quarter were:

“Cybercriminals only need one person to click the link or open the door to enable malware installations,” Jennings said. “This action allows cybercriminals to gain access to networks, data and infrastructure. Once inside the network, cybercriminals will gain access to the ‘keys to the kingdom’ and exfiltrate intellectual property and possibly make the organization’s data unavailable by exploiting them with ransomware. With ransomware, cybercriminals will request a large sum of money to hand over the decryption key in order to get their data back.”

MSSPs can provide the technology resources organizations need to protect themselves, he said. They can do this by implementing multiple layers of depth to protect the various applications and data within an organization.

“Further protection and risk reduction activities such as security awareness training for employees, the human aspect, and phishing assessments, should be implemented,” Jennings said. “These assessments allow the organization’s decision makers to recognize improvement areas and to help strengthen their human firewalls.”