Ride the Lightning

The Top 10 Phishing Subject Lines for the 3rd Quarter of 2018

October 25, 2018

We always like to see what subject lines phishing emails are baited with, right? Yesterday, KnowBe4 released its Third Quarter 2018 Top-Clicked Phishing Report.

The messages in the report, which were compiled from analyzing KnowBe4 user data, are based on simulated phishing tests users received or real-world emails sent to users who then reported them to their IT departments. The top three messages for Q3 2018 show that hackers are playing into users’ commitment to security, with password checks, as well as their curiosity, with a new voicemail or order on its way.

A recent report by Willis Towers Watson and ESI ThoughtLab found that 87% of firms see untrained staff as the greatest cyber risk to their business. Compounding this finding is the fact that staff training is ranked among the categories to have made the least progress when measured against the National Institute of Standards and Technology (NIST) cybersecurity framework. The research also identified the most common types of attacks include malware/spyware (81%) and phishing (64%).

“Hackers are leveraging an individual’s desire to remain security minded or well informed by playing into his/her psyche,” said Perry Carpenter, chief evangelist and strategy officer, KnowBe4. “They do this by making someone believe they are at risk or that something needs immediate attention. These types of attacks are effective because they cause a person to simply react before thinking logically about the legitimacy of the email. Managing the ongoing problem of social engineering is becoming more and more difficult as hackers play into human emotions by causing feelings of alarm or curiosity.”

KnowBe4 examined tens of thousands of email subject lines from simulated phishing tests to uncover just what makes a user want to click. They also examined ‘in-the-wild’ email subject lines that show actual emails users received and reported to their IT departments as suspicious.

The Top 10 Most-Clicked General Email Subject Lines Globally for Q3 2018 include:

    Password Check Required Immediately 29%

    You Have a New Voicemail 13%    

    Your order is on the way 11%

    Change of Password Required Immediately 10%

    De-activation of [email] in Process 9%

    Password Check Required Immediately 6%

    UPS Label Delivery 1ZBE312TNY00015011 6%

    Revised Vacation & Sick Time Policy 6%

    You’ve received a Document for Signature 5%

    Spam Notification: 1 New Messages 5%

When investigating only ‘in-the-wild’ email subject lines, KnowBe4 found the most common for Q3 2018 included:

    You have a new encrypted message

    IT: Syncing Error – Returned incoming messages

    HR: Contact information

    FedEx: Sorry we missed you.

    Microsoft: Multiple login attempts

    IT: IMPORTANT – NEW SERVER BACKUP

    Wells Fargo: Irregular Activities Detected on Your Credit Card

    LinkedIn: Your account is at risk!

    Microsoft/Office 365: [Reminder]: your secured message

    Coinbase: Your cryptocurrency wallet: Two-factor settings changed

This is very much in line with what we see at Sensei, both from our clients – and what we see ourselves. Most of them are trapped as spam, but never all of them.

If you are not giving your employees simulated phishing tests, you are not doing a good job of managing your cybersecurity risk. Strengthen that human firewall with training!

E-mail:    Phone: 703-359-0700
Digital Forensics/Information Security/Information Technology
https://www.senseient.com
https://twitter.com/sharonnelsonesq
https://www.linkedin.com/in/sharondnelson
https://amazon.com/author/sharonnelson