There has been a significant rise in phishing email attacks related to HR topics, especially those regarding new policies that would affect all employees throughout many types of organizations. Real phishing emails that were reported to IT departments related to security-minded users about password checks continue to remain popular. Phishing email attacks leveraging COVID-19 were on every quarterly report in 2020, but those subjects have dropped dramatically in 2021. End users have become more savvy about scams related to that topic.

With more employees returning to the office, they are concerned about new policies that affect their everyday situations at work, which is why we are seeing a rise in these types of phishing attacks. These days, it is especially important for all end users to take a moment to double check a link or attachment and to question whether the email is expected or unexpected. Employees are truly an organization’s last line of defense.

LinkedIn Still Draws the Most Social Media Subject Clicks

LinkedIn phishing messages have dominated the social media category for the last three years. Users may perceive these emails as legitimate since LinkedIn is a professional network, which could pose significant problems because many LinkedIn users have their accounts tied to their corporate email addresses. Top-clicked subjects in this category also include Facebook and Twitter notifications, message alerts and login alerts. See the full infographic with top messages in each category for last quarter.

{ image source frpm Knowbe4 }
In Q2 2021, we examined tens of thousands of email subject lines from simulated phishing tests. We also reviewed ‘in-the-wild’ email subject lines that show actual emails users received and reported to their IT departments as suspicious. The results are below.
The Top 10 Most-Clicked General Email Subject Lines for the Past Quarter Include:

• Password Check Required Immediately
• Vacation Policy Update
• Important: Dress Code Changes
• ACH Payment Receipt
• Test of the [[company_name]] Emergency Notification System
• Scheduled Server Maintenance -- No Internet Access
• COVID-19 Remote Work Policy Update
• Scanned image from MX2310U@[[domain]]
• Security Alert
• Failed Delivery
  

Most Common ‘In-The-Wild’ Emails for Q2 2021:

• Zoom: Important issue
• IT: Information Security Policy Review
• Mastercard: Confirmation: Your One-Time Password
• Facebook: Your account has been temporarily locked
• Google: Take action to secure your compromised passwords
• Microsoft: Help us protect you - Turn on 2-step verification to protect your account
• Docusign: Lucile Green requests you to sign Mandatory Security Training documents
• Internship Program
• IT: Remote working missing updates
• HR: Electric Implementation of new HRIS