Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Credential Harvesting at Scale Without Malware

Summary: Unit 42 reports that business email compromise and personal email account compromise accounted for at least $1.86 billion in U.S. losses in 2020, a 5% increase over 2019 and 45% of all reported cybercrime losses that year, according to the FBI's annual report. The newer credential-harvesting technique combines spear phishing, custom webpages mimicking legitimate login screens, and the cloud single sign-on ecosystem, with stolen credentials sent via HTTP post to URLs typically ending in *.php and stored in a database.

What's compelling: The largest known ransomware payoff to date is $40 million, against $1.86 billion in BEC and EAC losses in a single year, and these scams carry no trojans, spyware or keyloggers for security products to catch because they use exact copies of legitimate webpages. Scammers also increasingly host them on previously compromised legitimate domains, which defenders often cannot block without cutting off required business content.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Phishing & Social Engineering
Related