Vishing, smishing, and quishing are next ways to go phishing

Credit: Dejan Marjanovic/Getty
Security experts have reported a surge in new phishing techniques that don’t use email - is your cybersecurity ready for vishing, smishing, and quishing?

Organisations in highly regulated industries such as insurance, banking, legal, healthcare and financial services were most targeted by cybercriminals in 2022 using new techniques, including vishing (voice phishing), smishing (SMS phishing) and quishing (QR code phishing), according to new research.

According to cloud security company Lookout’s Global State of Mobile Phishing report, last year had the highest mobile phishing encounter rates, with an average of more than 30% of personal and enterprise users exposed to these attacks every quarter. 

The company also found that users on all devices – whether personal or work provided – are tapping more on mobile phishing links than just two years ago.

"Mobile as a threat surface will continue to grow, and hybrid work continues to grow in tandem, introducing huge numbers of unmanaged devices into the enterprise environment," says Aaron Cockerill, chief strategy officer at Lookout. "It is more important now than ever for organisations to evolve their cybersecurity strategy to proactively combat mobile phishing."

Key report findings include:

  • The potential annual financial impact of mobile phishing to an organisation of 5,000 employees is nearly $4 million.
  • Since 2021, mobile phishing encounter rates have increased by roughly 10% for enterprise devices and more than 20% for personal devices.
  • In 2022, over 50% of personal devices were exposed to a mobile phishing attack every quarter.
  • The percentage of users falling for multiple mobile phishing links in a year is increasing rapidly year over year.
  • Organisations operating in highly regulated industries – including insurance, banking, legal, healthcare and financial services – were the most heavily targeted enterprises.
  • Non-email-based phishing attacks are growing rapidly, with vishing (voice phishing), smishing (SMS phishing) and quishing (QR code phishing) increasing seven-fold in the second quarter of 2022.

The increasingly interconnected nature of users, endpoints, and applications has made it easier for threat actors to launch advanced attacks by stealing user credentials. Mobile phishing has emerged as one of the most successful tactics for stealing login credentials, posing significant security, compliance, and financial risks to organisations across all industries. The rise of remote work has likely contributed to this, as companies have relaxed their bring-your-own-device (BYOD) policies to accommodate employees accessing corporate networks beyond traditional security perimeters.

Moreover, mobile phishing attacks are becoming more sophisticated, with many enterprise mobile users clicking on more than six malicious links annually. In 2020, only 1.6% of mobile users in enterprise environments clicked on more than six malicious links, which surged to 11.8% in 2022. This trend highlights the growing difficulty that users face in distinguishing phishing messages from legitimate communications.

“As one of the most effective attack vectors for threat actors, often serving as a starting point for more advanced attacks, mobile phishing protection should be a top priority for organisations of any size," says Cockerill. 


Featured Articles

CrowdStrike & HPE: Unifying IT and Security for Secure AI

CrowdStrike and HPE are joining to integrate their Falcon platform and GreenLake cloud and OpsRamp AIOps to give an overview of AI infrastructure

Zscaler and NVIDIA Join to Upskill Zero Trust with Gen AI

NVIDIA is joining with Zscaler to help integrate its AI solutions into their Zero Trust Exchange platform and Zscaler ZDX Copilot

Gigamon Sound Alarm on Cloud Security as Unseen Attacks Soar

Gigamon's latest Hybrid Cloud Security Survey shows unseen cyber attacks have increased 20% year on year

Helping APAC Curb the Threat of Cyber Attacks

Hacking & Malware

SolarWinds: IT Staff Dubious on Organisation's AI Readiness

Technology & AI

Is Stress a Driving Force Behind the Cyber Skills Shortage?

Operational Security