Users fall for these Email Phishing subjects the most
Is phishing still a thing? KnowBe4, a security training company, released details on the top clicked phishing email subjects of the fourth quarter of 2018; in other words: the subject lines that get unsuspecting users to interact with phishing emails the most.
The data comes from two sources: simulated phishing emails used by KnowBe4 customers and Phish Alert Button interactions.
Phishing is quite the problem on today's Internet. While additional security features such as two-factor authentication may block some attacks dead in their track, it all comes down to users in the end.
Attackers invent new ways to trick users. In 2017, they used Punycode domains to make domain names look like the real deal, or Google phishing emails that gave the attacker access to emails and contacts.
The following email subjects top the list:
- Password Check Required Immediately/Change of Password Required Immediately 19%
- Your Order with Amazon.com/Your Amazon Order Receipt 16%
- Announcement: Change in Holiday Schedule 11%
- Happy Holidays! Have a drink on us. 10%
- Problem with the Bank Account 8%
- De-activation of [[email]] in Process 8%
- Wire Department 8%
- Revised Vacation & Sick Time Policy 7%
- Last reminder: please respond immediately 6%
- UPS Label Delivery 1ZBE312TNY00015011 6%
Several of these subjects are Holiday themed; these will change in the coming quarters. Common themes include shipping and delivery emails, security related emails, company policy emails, and seasonal emails.
Passwords and security, as well as email subjects that demand action or are of concern to the user, are commonly used in phishing emails.
The company tracks social media email subjects separately.
The top list looks like this:
- LinkedIn email subjects, e.g. Add Me, Join My Network, New Endorsements, Profile Views 39%
- Facebook email subjects, e.g. Password change or Primary email change.
- Pizza, e.g. free pizza or anniversary, 10%
- Motorola login alerts, 9%
- New Voice Message, 6%
- Your friend tagged a photo, 6%
- Your password was successfully reset, 6%
- Secure your account, 4%
- You have a new unread message, 3%
It is surprising that LinkedIn tops the list and not Facebook. Several security related messages are in the top ten, but most social media email subjects used to phish data focuses on interaction on the service.
Closing Words
Phishing attacks have evolved over the years; it is no longer enough to push millions of emails with phishing links to users. Attackers create emails that spark user interest or concern, and put effort in creating email subjects that catch a user's attention as these determine whether a user opens the email to read the body content (and interact with it) or not.
Most phishing attacks would fall short if users would never click on links in emails.
Now You: What is your take on phishing in 2018? Still as much a threat as in 2010?
Doesn’t Windows 8 know that www. or http:// are passe ?
Well it is a bit difficulty to distinguish between name.com domains and files for instance.
I know a service made by google that is similar to Google bookmarks.
http://www.google.com/saved
@Ashwin–Thankful you delighted my comment; who knows how many “gamers” would have disagreed!
@Martin
The comments section under this very article (3 comments) is identical to the comments section found under the following article:
https://www.ghacks.net/2023/08/15/netflix-is-testing-game-streaming-on-tvs-and-computers/
Not sure what the issue is, but have seen this issue under some other articles recently but did not report it back then.
Omg a badge!!!
Some tangible reward lmao.
It sucks that redditors are going to love the fuck out of it too.
With the cloud, there is no such thing as unlimited storage or privacy. Stop relying on these tech scums. Purchase your own hardware and develop your own solutions.
This is a certified reddit cringe moment. Hilarious how the article’s author tries to dress it up like it’s anything more than a png for doing the reddit corporation’s moderation work for free (or for bribes from companies and political groups)
Almost al unlmited services have a real limit.
And this comment is written on the dropbox article from August 25, 2023.
First comment > @ilev said on August 4, 2012 at 7:53 pm
For the God’s sake, fix the comments soon please! :[
Yes. Please. Fix the comments.
With Google Chrome, it’s only been 1,500 for some time now.
Anyone who wants to force me in such a way into buying something that I can get elsewhere for free will certainly never see a single dime from my side. I don’t even know how stupid their marketing department is to impose these limits on users instead of offering a valuable product to the paying faction. But they don’t. Even if you pay, you get something that is also available for free elsewhere.
The algorithm has also become less and less savvy in terms of e.g. English/German translations. It used to be that the bot could sort of sense what you were trying to say and put it into different colloquialisms, which was even fun because it was like, “I know what you’re trying to say here, how about…” Now it’s in parts too stupid to translate the simplest sentences correctly, and the suggestions it makes are at times as moronic as those made by Google Translations.
If this is a deep-learning AI that learns from users’ translations and the phrases they choose most often – which, by the way, is a valuable, moneys worthwhile contribution of every free user to this project: They invest their time and texts, thereby providing the necessary data for the AI to do the thing as nicely as they brag about it in the first place – alas, the more unprofessional users discovered the translator, the worse the language of this deep-learning bot has become, the greater the aggregate of linguistically illiterate users has become, and the worse the language of this deep-learning bot has become, as it now learns the drivel of every Tom, Dick and Harry out there, which is why I now get their Mickey Mouse language as suggestions: the inane language of people who can barely spell the alphabet, it seems.
And as a thank you for our time and effort in helping them and their AI learn, they’ve lowered the limit from what was once 5,000 to now 1,500…? A big “fuck off” from here for that! Not a brass farthing from me for this attitude and behaviour, not in a hundred years.