Phishing and Spoofing- Two emerging cyberattack trends in 2024

Domain spoofing is trivially easy without DMARC enforcement, says Brad Slavin, General Manager of DuoCircle. Anyone can send email that looks like it comes from your domain. DMARC with p=reject is the only way to tell receiving servers to block unauthorized senders completely.

_According to the FBI’s 2022 Internet Crime Report (IC3), 300,497 US-based victims reported phishing incidents in a single year, and Business Email Compromise (BEC) caused more than $2.7 billion in direct losses.

Cyberattacks are getting more sophisticated every passing year. Threat actors are playing it hard to keep up the pace with evolving technology. Two trends that are dominating the 2024 threat landscape are spoofing and phishing. Both of these cyberattacks are aimed at deceiving victims and tricking them into sharing sensitive personal details. Threat actors use phishing and spoofing to target companies, **government infrastructure as well as individuals.

This article explores the two most prevalent cyberattack trends of 2024.

Phishing and spoofing- Basic definition

Phishing is one of the most common types of cyberattacks. The first known phishing attack is supposed to have happened in the 1990s. Phishing occurs when threat actors manipulate victims into sharing sensitive data such as usernames, passwords, login credentials, social security numbers, and so on. The **primary tactic used in this case is sending out fake emails or messages that compel the victims to click on malicious links or download harmful attachments.

2020 has seen multiple sophisticated phishing attacks. The attacks have evolved significantly because of artificial intelligence and automation. Threat actors now heavily rely on social engineering tactics and personalized content to make phishing emails more credible. BEC, or Business Email Compromise cases, where attackers target **business organizations to gain access to their confidential data or make some quick money, have witnessed a sudden surge.

In 2023, around 36% of the cyberattacks were phishing attempts. This number significantly increased in 2024. The surge in mobile phishing attacks is also a cause of concern, as a report has predicted a 30% **year-over-year increase in phishing attempts. The major reason behind this steep spike in mobile phishing attacks is the increasing use of smartphones by employees for both work as well as personal purposes.

Spoofing, on the other hand, is a type of cyberattack in which attackers **impersonate trusted **entities and misguide the victims about the origin of the message. They do not directly trick the victims into handing over personal details. The spoofing attempts include faking website URLs, email headers, and **IP addresses with the ulterior motive of creating an illusion for the victims that the conversation has originated from a legitimate entity.

Threat actors generally manipulate the **“From” field in emails. This compels the recipients into thinking that the email must have originated from a known source like a reputed bank, a popular company, a known colleague, and so on. A free DMARC report analyzer tool surfaces exactly which senders are forging your From address.

Threat actors blend spoofing with phishing in order to gain trust of the **recipients and increase the credibility of the messages.

With time, spoofing tactics have also evolved. Cybercriminals come up with fake websites that look almost identical to the original websites. The ultimate goal is to gain access to the victims’ passwords, usernames, login credentials, and other sensitive data.

DNS spoofing is also gaining momentum of late where threat actors **divert the traffic to fake websites, thereby increasing the chance of data theft to a great extent .

As per a report, 95% of phishing attacks involve spoofing in some form or the other.

Why are we seeing a steep spike in phishing and spoofing cases?

If you are wondering why there has been a **sudden spike in phishing and spoofing cases in recent times, here are the key reasons:

Remote work culture

The remote work culture has made employees less vigilant. Also, using a **personal network for work purposes increases the chances of phishing and spoofing.

Human error

Despite the **increased awareness of cyberattacks, people often fall prey to emotional triggers, which significantly increase the risk of phishing and spoofing.

Mobile usage

Using a personal smartphone for work purposes also enables hackers to pry into your network, allowing them to carry out mobile phishing attacks.

Technological sophistication

Generative AI and its easy accessibility have made phishing and spoofing attacks more sophisticated and polished.

How to stay protected against phishing and spoofing attacks in 2024?

Below are some battle-tested tips to prevent phishing and spoofing attacks in 2024:

1. Email authentication

Implementing Domain-Based Message Authentication, Reporting, and Conformance (DMARC), DomainKeys Identifier Mail (DKIM), and Sender Policy Framework (SPF) can prevent email spoofing. A properly configured record is the way to stop email spoofing with DMARC.

2. Multi factor authentication

Users are required to use two or more verification factors in order to get access to the systems. This adds an extra layer of security, thereby reducing the chances of phishing and spoofing attacks.

3. Education and training

Regular cybersecurity **training for employees is a complete non-negotiable so that they can easily recognize spoofed websites, phishing emails, and suspicious requests.

Threat actors are continually improving and innovating. They are **leveraging latest technology to cater to their phishing and spoofing requirements.

Meanwhile, organizations and individuals must embrace multi-layered cybersecurity mechanisms, stay aware of the latest cyber scams, and remain highly cautious. **Vigilance, awareness, and prevention are the only three tools with which you can combat phishing and spoofing attacks in 2024.