Analysis of over 55.5 Million Emails by Enterprise Cloud-Native Security Firm Avanan Provides a Stark Picture of Threat Landscape

SECUREWORLD, PHILADELPHIA AND NEW YORK – April 10, 2019 – Avanan, an enterprise cloud-native security firm, released its “Global Phish Report,” the product of extensive research today at the SecureWorld Conference. The report analyzed 55.5 million emails sent to organizations using Microsoft Office 365 and Google G Suite. The study reveals that 25% of phishing emails bypass Office 365 security, using malicious links and attachments as the main vectors. Other concerning findings include that 33% of emails containing a link to a site hosted on WordPress and 98% of emails containing a crypto wallet address are phishing attacks.

These numbers are likely to increase as hackers design new obfuscation methods that take advantage of zero-day vulnerabilities on platforms such as Office 365 and G Suite.

“Cloud-based email, despite all of its benefits, has unfortunately launched a new era of phishing attacks,” said Yoav Nathaniel, lead security analyst at Avanan. “The nature of the cloud provides more vectors for hackers and gives them broader access to critical data when a phishing attack is successful. Organizations are in desperate need for more information on phishing attacks and how to combat these attacks. We conducted this research to help inform organizations and shed light on how to keep sophisticated attacks out of their environment.”

Over the past decade, phishing attacks have become the most widespread digital threat to organizations around the globe. For most organizations, phishing is the number one email security threat, outranking both malware and ransomware. These attacks are becoming increasingly sophisticated and difficult to detect, even with the aid of artificial intelligence to support the effort. Employees are bombarded with spear phishing, extortion, credential harvesting, and malware attacks. The cloud email platforms by themselves cannot reliably block emails containing malicious language, links, or attachments.

Other Key Findings

  1. Over 30% of phishing emails sent to organizations using Office 365 Exchange Online Protection were delivered to the inbox.

  2. Over 50% of all phishing emails contain malware, credential harvesting accounts for 40.9%, and spear phishing and extortion make up the remaining 8.4% (0.04% and 8%, respectfully).

  3. One out of every 25 branded emails sent to organizations were found to be phishing emails, with Microsoft being the most impersonated brand throughout the year, except for the holiday season, during which it is Amazon.

A full copy of the Avanan Global Phish Report, including recommendations based on the findings, is available online at https://www.avanan.com/Global-Phish-Report

The announcement came at SecureWorld Philadelphia, a conference dedicated to helping security practitioners aid their firm improve not only their individual security posture, but also to make the overall security environment better and easier to manage.

About Avanan
Avanan automates the ongoing security of cloud-based email, messaging, and file-sharing. Making risk management and compliance easier, Avanan deploys in minutes to block phishing, malware, data leakage, account takeover, and shadow IT. From Fortune 500 companies to school districts, millions of inboxes around the world are protected by Avanan and its trusted partners, like Check Point and FireEye, whose technology is available on demand from the platform.