New phishing scheme combining spear phishing tactics in mass phishing campaigns

Kaspersky experts have identified a new phishing attack trend where elements of spear phishing are being used in bulk campaigns. Traditional bulk phishing emails target large audiences with generic messages, often rife with typos and simplistic formatting. In contrast, spear phishing involves highly personalized messages including specific details about the target, making them appear more credible. 

Spear phishing targets specific individuals or small groups with emails that mimic the style and content of legitimate communications from trusted entities, that are meticulously crafted to avoid detection by security filters, and often contain no technical errors. Mass phishing campaigns meanwhile cast a wide net, sending generalized messages to large lists of email addresses lacking personalization and often contain mistakes and poor design.

In late 2023, Kaspersky researchers observed a statistical anomaly indicating a blend of spear and mass phishing tactics, with emails detected that were too aggressive for spear phishing, but too sophisticated for mass phishing. In one instance, an HR phishing email addressed the recipient by name and referenced their company, yet the linked phishing form was a generic fake Outlook sign-in, a typical sign of mass phishing.

An HR phishing email message using ghost spoofing: the sender’s name contains 
the HR team’s email address, lending an air of authenticity to the email

Another campaign employed “ghost spoofing”, where a real corporate email address appeared in the sender’s name without modifying the actual domain. This technique, usually reserved for targeted attacks, was used in mass phishing, adding an air of authenticity, but leading to a generic phishing form upon clicking the link.

The number of mixed phishing emails, March-May, 2024

Between March and May 2024, Kaspersky detected a significant increase in these hybrid phishing emails. This rise indicates that attackers are leveraging advanced technologies to reduce the cost and effort of personalizing mass attacks. AI-powered tools can now create convincing email content, fix typos, and enhance design, making these mixed attacks more effective and harder to detect.

Attackers are increasingly adopting spear phishing methods and technologies in their bulk campaigns, leading to more personalized emails and an expanding range of spoofing technologies and tactics. Despite being mass email campaigns, these attacks present a significant threat. To combat this evolving threat, it is crucial to implement safeguards that keep pace with technological advances and employ a combination of methods and services comments Roman Dedenok at Kaspersky.