{"id":2495,"date":"2024-01-09T15:51:38","date_gmt":"2024-01-09T15:51:38","guid":{"rendered":"https:\/\/cwsisecurity.com\/?p=2495"},"modified":"2026-05-04T13:53:44","modified_gmt":"2026-05-04T12:53:44","slug":"phishing-in-2024-five-modern-tactics","status":"publish","type":"post","link":"https:\/\/cwsisecurity.com\/nl\/phishing-in-2024-five-modern-tactics\/","title":{"rendered":"Phishing in 2024: Five Modern Tactics"},"content":{"rendered":"\n

Phishing remains a persistent and pervasive threat in the digital landscape, preying on end users and organisations alike. As technology advances, phishing campaigns continue to improve in sophistication, emphasising on the need for vigilance and awareness. To support your organisation in better protecting itself against this ever-present threat, here is an overview of the five most emerging phishing trends in 2024. \u00a0<\/p>\n\n\n\n

Despite being one of the oldest types of cyberattacks, phishing continues to pose significant challenges to organisations of all sizes, in all sectors. Cybercriminals continue to evolve their phishing attack techniques, experimenting with different lures, adopting new social engineering tricks, and embracing new ways to avoid detection.<\/p>\n\n\n\n

In this blog we share valuable insights into the latest ways threat actors try to bypass your organisation\u2019s defences and zoom in on how to better protect yourself.<\/p>\n\n\n\n

<\/div>\n\n\n\n

What are Phishing Tactics?<\/h2>\n\n\n\n
<\/div>\n\n\n\n

likelihood of experiencing a phishing attack. This is when an attacker aims to steal valuable data, such as login details or <\/strong>bank account<\/strong><\/a> information.<\/strong><\/p>\n\n\n\n

<\/div>\n\n\n\n

Five 2024 Phishing Trends<\/h2>\n\n\n\n
<\/div>\n\n\n\n

The following five phishing tactics are being experienced by firms in 2024:<\/p>\n\n\n\n

    \n
  1. Emails sent from trusted third parties<\/li>\n\n\n\n
  2. Emails with legitimate URLs<\/li>\n\n\n\n
  3. OneNote Malware<\/li>\n\n\n\n
  4. OAuth device code phishing<\/li>\n\n\n\n
  5. Other targeted phishing attempts<\/li>\n<\/ol>\n\n\n\n
    <\/div>\n\n\n\n

    Emails Sent From Trusted Third Parties<\/mark><\/h3>\n\n\n\n
    <\/div>\n\n\n\n

    Attackers increasingly send phishing emails to all the contacts of their victims and then respond on the email thread with specially crafted messages and a malicious URL.<\/p>\n\n\n\n

    <\/div>\n\n\n\n
    \n
    \n

    Emails with Legitimate URLs<\/mark><\/h3>\n\n\n\n
    <\/div>\n\n\n\n

    Attackers host phishing URLs on legitimate cloud service providers such as Adobe<\/a>, Dropbox<\/a>, Google, and Microsoft<\/a>. After multiple redirects, victims are led to the \ufb01nal landing page, which steals credentials or downloads malicious payloads onto their machine. Given these are popular services, it is di\ufb03cult to distinguish malicious links from genuine ones.<\/p>\n\n\n\n

    <\/div>\n\n\n\n

    OneNote Malware<\/mark><\/h3>\n\n\n\n
    <\/div>\n\n\n\n

    Attackers abuse OneNote to execute malicious software. Phishing campaigns observed by Microsoft Defender Experts include OneNote attachments, URLs leading users to download OneNote attachments, and PDFs containing URLs that led to OneNote malware downloading.<\/p>\n<\/div>\n\n\n\n

    \n
    \"Rounded<\/figure>\n<\/div>\n<\/div>\n\n\n\n

    OAuth Device Code Phishing<\/mark><\/h3>\n\n\n\n
    <\/div>\n\n\n\n

    The attacker generates a user<\/a> code, then creates a phishing email with it and a link to provide the code. This allows the attacker to sign-in on behalf of the user.<\/p>\n\n\n\n

    <\/div>\n\n\n\n

    Other Targeted Phishing Attempts<\/mark><\/h3>\n\n\n\n
    <\/div>\n\n\n\n

    Microsoft\u2019s experts also observed targeted phishing attempts in which attackers identi\ufb01ed user-speci\ufb01c details through social engineering, then created tailored phishing campaigns using look-alike domains to which the users have subscribed, with contents matching the users\u2019 interests. This signi\ufb01cantly increases the success rate of a compromise attempt.<\/p>\n\n\n\n

    <\/div>\n\n\n\n

    How to Step Up Your Game<\/mark><\/h2>\n\n\n\n
    <\/div>\n\n\n\n

    The first step in defending your business against phishing is making sure that your employees know that these attacks exist and what they consist of. With education being one of the best defences against phishing, phishing simulation tools are a great way to decrease click rates and possible data breaches.<\/p>\n\n\n\n

    Want to learn more about how Microsoft\u2019s Attack Simulation Training can empower your employees to defend against phishing attacks? Catch up below on our ‘Security Awareness with Microsoft Webinar<\/a>‘ where our Microsoft security experts help you get up to speed on the trainings key capabilities and best practices with regards to the set-up, deployment, and reporting.<\/p>\n\n\n\n

    <\/div>\n\n\n\n
    \n