Zimperium is warning organizations about the escalating threat of mobile phishing attacks, highlighting the trends and changing attack tactics.
Mobile phishing includes various forms such as SMS phishing (smishing), voice phishing (vishing), app-based phishing, email phishing, and social media phishing. While some of phishing campaigns appear to target consumers, they can serve as a trojan horse to deliver malware, capture reused passwords, or hijack OTPs, ultimately infiltrating corporate networks and applications on the device.
At present, according to a Zimperium analysis, 78% of phishing sites are specifically targeting mobile browsers, making mobile devices a prime target. These attacks are becoming increasingly sophisticated, with 60% of new phishing domains obtaining an SSL certificate within the first 2 hours of being registered, making them quickly operational over a secure connection.
The analysis reveals that while 50% of phishing sites are discovered within the first week of being created, the remaining half remain active as zero-day threats for longer than a week. This underlines the critical need for real-time, on-device detection to protect users effectively.
Additionally, attackers are leveraging domains to host multiple fraudulent sites, often targeting brands that are commonly associated or share the same geographic focus. This tactic increases the risk of credential theft as users often reuse passwords across different sites.
