Zscaler's 2022 ThreatLabz Phishing Report notes that it is relatively easy to run a phishing campaign, and that cybercriminals often use current events as a hook to trick victims into revealing confidential data, such as passwords, credit card information, and login credentials. Last year, the top phishing themes included productivity tools, illegal streaming sites, shopping sites, social media platforms, financial institutions, and logistical services.

The company predicts a further increase in phishing during 2022, in part due to the maturing underground marketplace for phishing as a service.

While phishing is a global problem, its incidence is not evenly spread.

Zscaler's figures show the US was the most-targeted country, accounting for over 60% of all phishing attacks blocked by the company. Singapore, Germany, the Netherlands, and the United Kingdom were next on the list.

And despite the global increase in phishing, the Netherlands experienced a decrease of 38%, which Zscaler suggests may be the result of recent increases in the penalties for online fraud.

Similarly, while the retail and wholesale industries experienced a 400% increase in phishing attacks, and the financial and government sectors saw an average increase of 100%, attacks on the healthcare industry fell by 59%, with a 33% decrease in attacks on the services industry.

"Phishing attacks are impacting businesses and consumers with alarming frequency, complexity, and scope – with the rise in phishing-as-a-service making it easier than ever for non-sophisticated actors to launch successful attacks. Our annual report highlights how cybercriminals continue to escalate their usage of phishing as a starting point to breach organisations to deliver ransomware or steal sensitive data," said Zscaler CISO and vice president of security research and operations Deepen Desai.

"To defend against advanced phishing attacks, organizations must leverage a multi-pronged defensive strategy anchored on a cloud native zero trust platform that unifies full SSL inspection with AI/ML-powered detection to stop the most sophisticated phishing attempts and phishing kits, lateral movement prevention and integrated deception to limit the blast radius of a compromised user, proactive controls to block high risk destinations such as newly registered domains that are often abused by threat actors, and in-line DLP to safeguard against data theft."

Zscaler suggests the following tactics for countering phishing growth:

• Learning and understanding the risks posed by phishing to better inform policy and technology decisions
• Leveraging automated tools and actionable intelligence to empower employees with the tools needed to reduce phishing incidents
• Delivering timely employee training to build security awareness and promote user reporting
• Simulating phishing attacks to identify gaps in security policies and procedures
• Evaluating security infrastructure to ensure access to the latest research and system capabilities

The 2022 ThreatLabz Phishing Report was based on an analysis of phishing data collected by the Zscaler security cloud between January and December 2021.