According to the “Q4 2022 Phishing and Malware Report” from email security firm Vade, phishing campaigns experienced a massive spike in the latter half of 2022, with a 61% increase in total phishing emails in Q4 compared to Q3. Furthermore, malware volumes increased by 12% quarter over quarter, with Vade detecting 58.9 million emails in Q4 2022 that included malware.

Email remains the top channel for distributing phishing and malware, as it provides a convenient, scalable, and efficient vehicle for exploiting users and compromising accounts. This trend highlights the need for organizations of all sizes to fortify their cybersecurity.

Breaking down the numbers by the month, phishing volumes remained relatively stable through the first half of Q4, with 62.3 million phishing emails tracked in October and 47 million in November. However, December saw a big jump in phishing emails, with 169 million recorded, representing a 260% month-over-month increase. This pattern is similar to what happened in the fourth quarter of 2021.

In terms of who they target and how they do it, phishing threat actors aren’t getting especially creative given the current way enterprise users work and collaborate. Facebook remained the top brand in terms of impersonation for the second consecutive quarter, with researchers observing 6,700 unique phishing URLs impersonating the social networking giant in Q4 2022. The company was followed by Microsoft, PayPal, Google, and Netflix in descending order as the brands that threat actors prefer to impersonate.

Phishers continued to find value in campaigns targeting productivity applications, for which they have a wide pool of corporate users and are most likely to find success. Microsoft 365, which has more than 345 million users, and Google Workspace, the second-most popular productivity suite, continued to be the top targets for phishers in the second half of 2022.

While some things remained the same in terms of phishing campaigns, changes are afoot in other aspects of this type of threat. In particular, new tools have emerged that can make anyone, even with limited skills, a phishing threat actor thanks to more sophisticated phishing-as-a-service (PaaS) kits and the meteoric rise in popularity of the AI platform ChatGPT.

By purchasing a phishing kit, novice hackers can deploy highly convincing and effective schemes against their targets. One recent enhancement to these kits is the ability to automatically localize phishing pages based on a victim’s native language, a handy tool that allows threat actors to target various regions quickly without being multilingual themselves. The feature works by identifying the language settings of the targeted user’s browser and leveraging it to update and display the phishing page accordingly.

ChatGPT is becoming a phisher’s best friend, according to Vade analysts. Hackers can weaponize ChatGPT to produce sophisticated phishing kits efficiently by using commands that empower the AI tool to write phishing emails and malicious code in seconds.

With phishing showing no sign of letting up despite being one of the oldest forms of cybercriminal activity, it’s clear that enterprises need to roll with the changes in the technology landscape just as attackers are.

According to previous research from Vade, nearly seven out of 10 businesses experienced a serious data breach that bypassed their email security in the past year. Moreover, the problem with phishing is that it doesn’t just end with an attacker giving up credentials. Ultimately, they can use these credentials as a way into corporate networks to steal data, distribute ransomware.