From faux password resets to convincing emails impersonating the CEO, phishing assaults have grow to be cybercriminals’ go-to weapon, and they’re working. Actually, over 90% of cyberattacks begin with phishing.
Powered by generative AI, attackers craft hyper-personalised, error-free messages at scale. In consequence, companies are usually not simply coping with unsolicited mail; they face monetary losses, reputational harm, and social engineering assaults that bypass instruments and go straight for individuals. To fight these next-gen threats, corporations are turning to superior cloud e-mail safety options constructed to detect and defuse refined phishing assaults.
This text will break down the commonest phishing assault sorts, backed by real-world examples focusing on a few of the largest manufacturers.
12 greatest phishing assaults in historical past: At a look
| Sort of assault | Entity affected | What occurred | Influence |
| E-mail phishing | Yahoo (2012–2016) | A number of breaches between 2012 and 2016, compromising names, emails, birthdates, and hashed passwords. | Popularity harm, acquisition value diminished by Verizon, and a $117.5 million authorized settlement in 2019. |
| Spear phishing |
Sony Footage Leisure (2014) | The hack started in retaliation for the discharge of The Interview, a comedy about assassinating North Korea’s chief. | Brought about vital disruption, huge knowledge leaks, reputational harm, monetary losses, and government resignations. Almost half of the 6,800 private computer systems and over half of its 1,555 servers have been worn out or destroyed. |
| Enterprise e-mail compromise (BEC) | Fb and Google (2013–2015) | Impersonated Quanta Laptop Inc., tricking workers into wiring funds through faux invoices that appeared like respectable enterprise transactions. | Fb was defrauded of $99 million, whereas Google misplaced roughly $23 million. |
| Whaling | Levitas Capital (2020) | The co-founder clicked a faux Zoom hyperlink, permitting attackers to entry programs and provoke fraudulent wire transfers whereas posing as executives. | $800,00 monetary loss, shut down on account of reputational harm. |
| Smishing |
Twilio (2022 & 2024) | Attackers impersonated Twilio’s IT division, sending SMS messages about password expiration containing a hyperlink to faux login pages mimicking Twilio’s sign-in portal. | Compromised worker credentials allowed unauthorized entry to the interior system and buyer knowledge. |
| Vishing | UK-based power agency (2019) | An AI-generated voice mimicking the agency’s German guardian firm CEO was used to trick the UK CEO into transferring $243,000 to a faux Hungarian provider. | $243,000 misplaced, and vital reputational harm. |
| Pharming | 50 monetary establishments (2011) | Refined pharming marketing campaign contaminated desktops, redirecting customers to faux web sites. | Contaminated 1000 desktops on daily basis for almost 3 days; main reputational harm. |
| HTTPS phishing | Change Healthcare (2024) | Attackers used HTTPS on faux websites to seem respectable, aiding credential theft. | 190M PHI data compromised, $22 million ransom paid through bitcoin. |
| Clone phishing |
Ubiquiti Networks Inc. (2015) | Attackers crafted emails that mimicked respectable inside messages from executives, directing finance employees to hold out wire transfers. The emails appeared genuine, possible utilizing a spoofed or lookalike area. | $46.7 million was stolen. Ubiquiti recovered $8.1 million, with one other $6.8 million legally frozen. Over $31.8 million remained unrecovered. Public disclosure broken popularity and belief. |
| Social media phishing |
Meta (Fb, Instagram, WhatsApp, and Messenger (2021) | Attackers arrange 39,000 + faux web sites that cloned Meta’s login pages and tricked customers into coming into credentials. | Account takeovers, id theft dangers, and broad social media privateness and safety compromises. |
| QR code phishing | Basic public within the UK (2024) | Fraudulent QR codes have been positioned in public locations (parking meters, menus), redirecting customers to malicious websites or apps. | Victims suffered monetary losses, together with unauthorized subscriptions and potential id theft. |
| Malvertising | Lowe’s workers | Pretend web sites mimicking Lowe’s worker portal, delivered by way of malicious Google advertisements, to steal worker credentials and gross sales knowledge. | Worker credentials compromised, knowledge possible bought to cybercriminals, breach disguised as a glitch. |
The commonest phishing assaults: Actual examples and surprising stats
There are various kinds of phishing assaults, and realizing these may also help you keep away from falling for them.
1. E-mail phishing
Topping the record, an estimated 3.4 billion phishing emails are despatched day by day throughout the globe. Cybercriminals use e-mail phishing to impersonate respectable corporations or faux to be somebody acquainted, tricking victims into offering their login particulars.
Yahoo knowledge breaches: Resulting in a $117.5 million settlement
Between 2012 and 2016, Yahoo skilled huge knowledge breaches that compromised over 3 billion person accounts, making it one of the vital vital breaches in historical past. Attackers stole delicate person data, together with names, e-mail addresses, telephone numbers, birthdates, and passwords.
The breaches went undisclosed for years, permitting cyber criminals to take advantage of the information extensively. In 2017, Yahoo publicly confirmed the extent of the violations, which severely broken its popularity and led to a big discount within the firm’s acquisition value by Verizon. The authorized fallout culminated in a $117.5 million settlement in 2019 to compensate affected customers.
Associated: Including layers like DomainKeys Recognized Mail (DKIM) can considerably block phishing on the supply.
2. Spear phishing
Spear phishing is a focused e-mail despatched to particular individuals to trick them into sharing personal data. Out of fifty billion analyzed throughout 3.5 million mailboxes, Barracuda researchers uncovered solely 0.1% as spear-phishing emails. Regardless of being uncommon, spear-phishing assaults trigger vital hurt once they succeed.
The Sony Footage Leisure hack: 47,000 SSNs leaked
In 2014, Sony Footage was hit by a large cyberattack. Hackers known as themselves the Guardians of Peace and broke into Sony’s laptop programs. The hackers infiltrated Sony’s programs utilizing a spear phishing marketing campaign, stealing terabytes of delicate knowledge, together with 47,000 Social Safety Numbers, government emails, and confidential worker data. The hacker’s primary purpose was to cease Sony from releasing a comedy film known as “The Interview”, which made mild of North Korea’s chief.
The breach crippled Sony’s operations: almost half of 6,800 private computer systems and over half of its 1,555 servers have been worn out or destroyed, and the corporate confronted appreciable embarrassment and belief points. Sony needed to delay the film’s launch, which value them tens of tens of millions of {dollars} in monetary losses. In addition they spent lots fixing their safety and coping with lawsuits from workers whose private knowledge was leaked. The hack confirmed how weak massive corporations might be to cyberattacks.
3. Enterprise e-mail compromise (BEC)
BEC is a rip-off during which dangerous actors hack or faux an organization e-mail account, often of a boss or trusted worker, to trick others into sending cash or delicate data. This type of fraud induced $2.8 billion in reported losses within the U.S. alone in 2024.
The Fb and Google bill rip-off: Over $100 million loss
Between 2013 and 2015, a Lithuanian named Evaldas Rimasauskas ran a complicated, large-scale rip-off that tricked Fb and Google out of over $100 million. He arrange a faux firm in Latvia that mimicked Quanta Laptop, a respectable {hardware} vendor with which each corporations did enterprise. The attacker despatched faux invoices and emails and satisfied Fb’s and Google’s workers to pay for items and companies that the attackers by no means delivered.
The rip-off exploited belief in vendor relationships and the corporate’s fee processes. Google misplaced about $23 million, and Fb misplaced round $98 million. Rimasauskas was extradited to the U.S., the place he pleaded responsible to wire fraud in 2019 and agreed to forfeit $49.7 million. He faces as much as 30 years in jail.
4. Whaling
Whaling is a phishing assault aimed toward high-profile targets like CEOs or high executives. Additionally it is a kind of BEC assault focusing on high-level executives akin to CEOs, CFOs, or administrators. These assaults rely closely on superior social engineering methods, utilizing extremely customized and convincing emails to trick leaders into authorizing giant funds or sharing delicate data. Whereas BEC can goal any worker inside an organization, whaling particularly focuses on high executives, rising the stakes and potential harm.
In 2021, one in each 3,226 emails acquired by an government was a whaling assault, and 59% of organizations reported that a minimum of one government had been focused.
The Levitas Capital collapse: Shut down on account of monetary and reputational harm
In 2020, Australian hedge fund Levitas Capital was hit by a whaling assault that led to its closure. The assault began when a co-founder clicked a faux Zoom hyperlink, which put in malware and gave attackers entry to the agency’s e-mail system. Then, they posed as executives and approved fraudulent transactions, inflicting a lack of about $800,000.
The monetary harm, together with the lack of their greatest shopper, compelled the agency to close down on account of reputational harm.
5. SMS phishing
Smishing, or SMS phishing, is a kind of phishing finished by way of textual content messages to steal data or cash. A zLabs Mishing Report reveals that India is essentially the most weak to smishing, with 37% of its inhabitants in danger, adopted by the U.S. at 16% and Brazil at 9%.
Twilio breach: 33 million telephone numbers stolen
In August 2022, Twilio, a serious cloud communications firm, was hit by a social engineering assault. Hackers tricked some Twilio workers and gained entry to delicate inside programs, permitting the attackers to steal knowledge about Twilio’s clients. Due to this breach, attackers accessed data from a minimum of 125 Twilio clients, inflicting severe knowledge safety and privateness considerations.
In 2024, Twilio was breached once more by a hacker group known as ShinyHunters, who claimed to have stolen 33 million telephone numbers from Twilio’s system. This later breach was a lot greater in scale. The 2022 assault revealed vulnerabilities in worker safety coaching and inside controls.
6. Vishing
Vishing, or voice phishing, is a rip-off during which attackers use telephone or voice calls to trick individuals into making a gift of delicate data. In 2022, phishing was the second most typical trigger of information breaches, costing organizations a mean of $4.91 million in breach bills.
2019 UK-based power firm rip-off: $243,000 stolen through deepfake voicecall
In 2019, a UK-based power firm fell sufferer to a extremely refined cyberattack that used synthetic intelligence to clone a CEO’s voice. Criminals used AI-powered voice-generating software program to impersonate the chief government of the corporate’s German guardian agency, efficiently convincing the UK CEO to urgently switch $243,000 to a fraudulent provider account in Hungary.
The scammers mimicked the German CEO’s accent and tone so precisely that the UK government believed the decision was actual. The attackers known as thrice, even following up with faux reassurances and requesting a second fee. Suspicion was raised solely after inconsistencies within the caller’s quantity and the promised reimbursement did not arrive. Specialists warned that conventional safety instruments are usually not outfitted to detect AI-generated audio, and as AI expertise turns into extra accessible, the chance of such assaults is rising.
7. Pharming
Pharming assaults redirect individuals from an actual web site to a faux one to steal their data with out their information. They’ll have an effect on everybody, from particular person customers to giant organizations, by hijacking DNS companies or infecting many gadgets to redirect victims to faux web sites.
In 2021, the FBI’s Web Crime Grievance Heart (IC3) reported 323,972 incidents below the mixed phishing/Vishing/Smishing/Pharming class, making it the top-reported cybercrime kind that 12 months.
International pharming assault: Over 50 banks focused
In 2007, cybercriminals launched a complicated pharming assault that focused clients of greater than 50 main monetary establishments worldwide, together with banks like Barclays, Financial institution of Scotland, PayPal, and American Categorical. As an alternative of counting on conventional phishing emails, this assault redirected customers from respectable banking web sites to fraudulent replicas with out their information. The attackers deployed malware that contaminated victims’ computer systems, silently redirecting them to faux banking websites designed to steal login credentials.
The assault affected hundreds of customers day by day, with infections estimated at round 1000 PCs per day throughout its peak. Though the total monetary impression was by no means publicly disclosed, this large-scale pharming marketing campaign demonstrated the evolving techniques of cybercriminals past basic phishing. It highlighted the necessity for stronger endpoint safety and DNS safety.
8. HTTPS phishing
Hypertext Switch Protocol Safe (HTTPS) phishing makes use of SSL/TLS certificates to make faux phishing websites seem respectable. The SSL certificates is projected to develop from $234.5 million in 2025 to $518.4 million by 2032, with a powerful compound annual development charge of 12% from 2025 to 2032.
Change Healthcare HTTPS assault: 190 million individuals affected
In February 2024, Change Healthcare suffered a serious ransomware assault by the ALPH/Blackcat group, which started with stolen credentials possible obtained by way of an HTTPS phishing assault. This breach uncovered the personal well being data of 190 million individuals, disrupting healthcare billing, insurance coverage claims, and pharmacy companies nationwide for weeks. UnitedHealth CEO Andrew Witty later confirmed the corporate paid a $22 million ransom in bitcoin to guard private data and mitigate additional harm.
9. Clone phishing
Hackers resend an actual, beforehand delivered e-mail however exchange a hyperlink or attachment with a faux one to trick workers into clicking and making a gift of data or downloading malware.
Ubiquiti Networks wire switch rip-off: $46.7 million in misplaced cyber heist
In 2015, networking firm Ubiquiti Networks fell sufferer to a big cyber heist during which attackers stole $46.7 million utilizing a kind of rip-off often known as CEO fraud. The attackers impersonated senior executives and despatched faux emails to the corporate’s finance division, tricking workers into sending wire transfers to abroad accounts. The San Jose–based mostly firm found the fraud in June 2015 and reported it in a monetary submitting.
The rip-off focused a Ubiquiti subsidiary in Hong Kong, the place funds have been transferred to third-party accounts in different nations. Ubiquiti recovered $8.1 million rapidly and positioned authorized holds on one other $6.8 million, however greater than $31 million remained unrecovered. The corporate stated there was no proof that its inside programs have been hacked or that workers have been concerned, however it admitted that its monetary controls have been weak on the time. The attackers possible used a faux e-mail area resembling Ubiquiti’s area title, a standard trick in CEO fraud.
10. Social media phishing
Billions of individuals scroll by way of platforms like Fb, Instagram, Snapchat, and LinkedIn to attach with individuals, sharing the whole lot from getting new canines to getting new job promotions. This makes the scammers’ job simpler when creating convincing scams. Assaults focusing on social media platforms accounted for 22.5% of all cyberattacks in This fall 2023, down from 30.5% within the earlier quarter, exhibiting a lower on this menace vector.
Fb’s 2021 authorized crackdown: 39,000 faux logins created
In 2021, Fb (now Meta) took authorized motion towards a large-scale phishing operation that focused tens of millions of customers throughout its platforms, together with Fb, Instagram, WhatsApp, and Messenger. Attackers created over 39,000 faux login web sites to steal customers’ credentials by impersonating respectable social media companies. These phishing websites have been distributed broadly by way of emails, social media messages, and posts, tricking numerous customers into coming into their usernames and passwords.
Meta’s lawsuit aimed to close down the infrastructure supporting this huge sprucing marketing campaign and maintain the perpetrators accountable. The operation highlighted the rising sophistication and scale of phishing assaults focusing on social media customers and underscored the significance of coordinated authorized and technical efforts to guard on-line communities.
11. Quishing
Quishing is a QR code-based phishing assault. In 2023, Barracuda discovered that about one in twenty e-mail inboxes was focused with malicious QR Codes, exhibiting how attackers even use QR scans to trick customers.
The 2024 UK quishing assault story: Reportedly, 1386 individuals affected
In 2024, organized crime teams within the UK launched a widespread quishing assault. They positioned fraudulent QR codes on on a regular basis public indicators like parking meters and restaurant menus. When individuals scanned these faux QR codes, they have been taken to malicious web sites or apps designed to steal their private and monetary data. Based on the UK’s nationwide fraud reporting heart, Motion Fraud, it acquired 1,386 stories of individuals being focused in 2024, a dramatic enhance from simply 100 circumstances in 2019. This displays how attackers are adapting outdated scams to new expertise.
Many victims ended up with unauthorized subscriptions and even confronted dangers of id theft. This intelligent rip-off focused most people and induced vital financial hurt. It highlighted how attackers use new, on a regular basis applied sciences like QR codes to trick individuals unexpectedly.
12. Malvertising
Malvertising is when malware or malicious code is hidden inside on-line advertisements. Within the fall of 2023, cybersecurity corporations reported a big 42% month-over-month spike in malvertising incidents throughout the U.S.
Lowe’s malvertising rip-off: Workers focused in a Google advert phishing rip-off
In mid-August 2024, attackers launched a complicated phishing scheme focusing on Lowe’s workers. They created a number of faux web sites resembling the official “MyLowe’sLife” worker portal, disguised as peculiar retail websites. These web sites have been possible generated utilizing AI to keep away from elevating suspicion.
The rip-off labored by exploiting person belief in search outcomes. Workers who looked for “myloweslife” noticed a number of faux advertisements that appeared above or alongside the respectable web site. Clicking one in every of these led to a phishing web page to steal usernames and passwords, doubtlessly giving attackers entry to delicate employment and payroll knowledge. After capturing the information, the faux web site redirected customers to the true Lowe’s portal, making the incident seem like a easy glitch.
Researchers recognized two separate advertiser accounts impersonating the MyLowesLife portal. In a single case, they noticed three malicious advertisements showing back-to-back. Many workers did not notice that attackers had compromised their delicate credentials and have been possible promoting them to different cybercriminals.
Phishing clues you’ll want you knew sooner
Validate earlier than you click on. Report suspicious exercise.
- Verify the e-mail deal with to see if it precisely matches the alleged sender. Scammers usually use addresses virtually similar to respectable ones however comprise refined typos or further characters (instance: Amaz0n as an alternative of Amazon).
- Phishing messages usually stress you with warnings like “your account shall be suspended!” or “Fast motion required!” designed to hurry you right into a mistake.
- Legit corporations don’t ask for delicate knowledge through e-mail. Watch out for password requests, social safety numbers, bank card particulars, or verification codes are purple flags.
- Be cautious of generic greetings, akin to “Pricey Buyer/Pricey Sir/Madam”.
- Be cautious of unknown information, particularly if they’re executable (.exe, .zip, .scr).
- Hover the mouse over the hooked up hyperlinks to examine the URL. If the URL appears suspicious, do not click on.
- Take a second to evaluate the e-mail/SMS earlier than taking any actions.
- Use organizations’ designated strategies to report phishing makes an attempt.
- To remain knowledgeable, repeatedly evaluate data on widespread phishing assaults. Attackers always evolve their techniques, so common updates on widespread scams enhance your consciousness.
If it smells fishy, simply do not click on
From a traditional textual content message to a QR code in a public place, it simply takes one second of distraction to get tricked. Most cybercrime isn’t as high-tech because it sounds. Simply belief that tiny voice in your head saying “uhh.. this feels bizarre” — that intestine really feel may be one of the best cybersecurity device you’ve got. The extra knowledgeable an individual is, the more durable they’re to deceive them.
From phishing to ransomware, cyberthreats are rising throughout the board. Take a look at our record of important cybercrime statistics each enterprise ought to know.