VIPRE Security Group’s Q3 2023 Email Threat Report: More Malicious Links, AI Improves Phisher Dupes

VIPRE Security Group, a global leader and award-winning cybersecurity, privacy and data protection company, today released its Q3 Email Threat Trends Report 2023. Analyzing nearly two billion emails, the report finds that cybercriminals are adapting their methods to reflect changing consumer habits, alongside capitalizing on evolving technology to deceive and evade getting caught.

Threat actors are increasingly hiding malicious links in Google Drive and other cloud storage spaces; PDFs as a malspam delivery tool have more than quadrupled since Q1 this year; and callback phishing and user-friendly Redline malware is on the rise.

Also, ChatGPT continues to improve phishers’ ability to dupe, and LinkedIn Slink is an unforeseen malicious workaround.

Key highlights of the report include:

• 233.9 million malicious emails detected in Q3 2023
• 110 million emails attributed to malicious content, 118 million to malicious attachments
• 150,000 emails displayed previously unknown behaviors.
• Threat actors favor link-based delivery (58%) over attachments (42%).
• Combined heuristic approaches detected roughly 10 times more spam instances than a similar signature-based detection approach

It’s clear from these findings that email threats remain a thorn in the side of cybersecurity teams. The 150,000 emails containing newly created exploits represent a concerning shift in the landscape.

Cybercriminals are also changing their delivery methods to reflect changing consumer habits. As cloud storage services have grown in popularity, so have they developed as a malspam delivery method, accounting for 67% of all malspam delivery methods in Q3 2023. Legitimate, compromised websites made up the remaining 33%.

Leveraging combined heuristics (Yara Rules) to significant effect in Q3 2023, VIPRE identified more than one million spam incidents across two distinct subsets: legacy heuristic rules caught 810,000, while new heuristic rules reeled in more than 72,000. To put this into perspective, traditional, signature-based approaches identified 150,000 overall. These numbers, again, represent a shift in the email security landscape as older defensive technologies struggle to keep pace with phishing-as-a-service offerings and an onslaught of novel malware models.

“It’s clear that the email threat landscape and cybercriminals are undergoing a period of rapid and dramatic evolution. Cybercriminals are extremely capable, informed, and effective; we mustn’t underestimate them,” said Usman Choudhary, chief product and technology officer at VIPRE. “However, by exposing cybercriminal attack methods and trends, through this report we aim to empower organizations to combat those who seek to do them harm. As the adage goes, one must know their enemy. This report will help the industry achieve that goal.”

The report also reveals how cybercriminals are increasingly utilizing AI tools to make their emails more believable. Only recently, many, if not most, spoof emails were betrayed by poor grammar, spelling mistakes, or strange formatting. Generative AI tools such as ChatGPT have made this detection method largely obsolete; at the click of a button, cybercriminals can produce literate, well-formatted emails that few can distinguish from legitimate communications.

To read the full Q3 Email Threat Trends Report 2023, download the full report here: https://www.vipre.com/email-threats-latest-trends-q3-2023. This is the third consecutive quarterly report. VIPRE leverages its unique understanding of email security to equip organizations with the information needed to protect themselves in the following quarter.

About VIPRE Security Group

VIPRE Security Group, part of Ziff Davis, Inc., is a leading provider of internet security solutions purpose-built to protect businesses, solution providers, and home users from costly and malicious cyber threats. With more than 25 years of industry expertise, VIPRE is one of the world’s largest threat intelligence clouds, delivering exceptional protection against today’s most aggressive online threats. Its award-winning software portfolio includes next-generation antivirus endpoint cloud solutions, advanced email security products, along with threat intelligence for real-time malware analysis, and security awareness training for compliance and risk management. VIPRE solutions deliver easy-to-use, comprehensive layered defense through cloud-based and server security, with mobile interfaces that enable instant threat response.

The group operates under various brands, including VIPRE®, StrongVPN®, IPVanish®, Inspired eLearning®, Livedrive®, and SugarSync®. www.VIPRE.com