Phishing Increasingly a Targeted Threat to Companies

One of the most commonly used tactics by cybercriminals to threaten users and businesses is phishing, a social engineering technique, meaning deception and manipulation, whose effectiveness lies in creating fraudulent messages from a seemingly legitimate source to access devices and infect them or steal confidential information. These messages are so convincing that it becomes difficult to identify an attack of this kind.

In 2023, Kaspersky solutions blocked 286 million phishing attack attempts in Latin America, representing a 617% increase compared to the previous year. In Mexico, 4,000 phishing incidents are recorded per minute, placing the country second in the region behind Brazil for the highest recurrence of this cybercrime technique. It is worth noting that 4 out of every 10 phishing attempts in the region target financial information (bank details, payment methods, financial services, and cryptocurrencies), according to Kaspersky's latest Threat Landscape for Latin America report.

In this context, it is important to highlight the vulnerability of businesses in Mexico, as the reactivation of economic activities after the pandemic and the rise of artificial intelligence are two factors that have fueled the increase in phishing attacks. Small and medium-sized enterprises (SMEs) can be particularly exposed, as they have less robust cybersecurity measures than large corporations, making them easier and more attractive targets for cybercriminals.

In 2023 alone, we detected 23,000 phishing attacks on SMEs in Mexico, and considering that the main goal is to obtain financial data, the consequences could have been devastating for these businesses. Speaking of companies in general, it is noteworthy that, although phishing attacks take various forms, they often target corporate email systems due to the large amount of valuable information that can be found there.

For example, the case of Pepco Group demonstrated the serious consequences that phishing attacks can have on an organization. At the end of February this year, the retail company reported that its Hungarian subsidiary had been the victim of a sophisticated attack of this kind, leading to the accidental transfer of money to fraudsters, resulting in the loss of approximately $17 million in cash.

However, the consequences of a successful phishing attack are not limited to financial aspects; the reputation of an organization can also be severely affected –  all potentially  triggered by a seemingly harmless email. It is not surprising that 8 out of 10 heads of IT security consider email to be the main source of cyberattacks, according to recent research. The problem is that corporate email is considered by most to be a confidential space, so if an employee receives an email from a partner, supplier, or other trusted source requesting access, data, or other sensitive information, it is likely to appear as a common communication that requires a reply.

The core point of this threat is that phishing emails often mimic legitimate communications from trusted sources. Additionally, to increase credibility, tactics such as spoofing sender addresses or replicating the corporate brand itself can be employed. The situation has become more critical with the emergence of AI-driven attacks, which allow for the use of sophisticated algorithms to create highly convincing and personalized fraudulent emails.

A recent example is the case of attacks targeting business accounts on Facebook, which utilize the legitimate infrastructure of the platform to send emails threatening to suspend these profiles. The emails appear legitimate because they come from this social network and contain alarming messages such as, "You have 24 hours to request a review. See why," appealing to the victims' sense of urgency and making it more likely for them to click on the links provided.

The evolution we detect in phishing attacks underscores the need to protect businesses through three vital strategies: training and raising awareness about the importance of multifactor authentication, as well as other protection and prevention practices among the workforce. In this regard, it is also important to ensure that sensitive data is safeguarded and that only authorized personnel have access to it.

The second strategy involves all robust cybersecurity measures that should be implemented to filter and ensure the security of corporate email accounts. It is important to consider that as the use of AI evolves to exploit vulnerabilities, there are also AI-driven solutions available to filter content in corporate email systems, thereby reinforcing their protection.

The third strategy is perhaps the simplest but the most necessary: alerting all members of an organization about the need to verify any audio, video, or text message they receive with an unusual request from an alleged coworker or boss. The advancement of AI compels us to verify as many times as necessary.

With these strategies in place, businesses, regardless of their size, can be proactive in the realm of cybersecurity and prevent the frequency of phishing attacks from adding them to the list of victims.