Skip to content
Saturday, 17 October 2026Threat Detection & DefenceCyber SafetyIdentity & AccessCloud SecurityDevices & IoT
Wire
01Cisco Umbrella Explained: Cloud Security for Users On and Off the Network02Why Remote Monitoring and Management Belongs in an MSP's Security Strategy03CyberArk Study Finds 95% of APJ Organisations Hit by Identity Breaches04Metaverse Security: The Attacks Businesses Expect as They Move Into Virtual Worlds
Press release

PhishLabs Report: Phishing Volume Up 22% in First Half, With Crypto and SSO Accounts in Focus

PhishLabs' quarterly threat report finds phishing up 22% in the first half, crypto firms hit tenfold harder, and 45% of phishing sites after SSO accounts.

Cybersecurity ASEAN editors · 3 min read

New PhishLabs Research Reveals Increase in Phishing Attacks

Phishing attacks in the first half of 2021 ran 22 percent higher by volume than in the same period of the previous year, according to the latest Quarterly Threat Trends and Intelligence Report from PhishLabs, a provider of Digital Risk Protection solutions. The figures also contained a surprise: after an exceptionally busy May, phishing volume fell sharply in June, the first such drop in six months.

John LaCour, founder and chief technology officer of PhishLabs, said criminals keep using phishing to steal proprietary information and are finding more sophisticated ways to do it, following growth in areas such as cryptocurrency and sites that rely on single sign-on. He called the steep fall between May and June 2021 interesting, and said the company would keep watching over the summer to see whether it marked a real improvement or whether attackers had simply taken a summer break.

Five main findings

  1. Cryptocurrency firms are a prime target. Phishing aimed at the sector rose tenfold compared with the previous quarter in 2021. Impersonation of brands, executives and employees together made up more than half (54.7 percent) of all social media attacks on cryptocurrency businesses. Attackers pose as these companies to mislead their customers and profit from the sector's rapid growth, on the very channel where most of the industry's communication happens.
  2. Social media is a growing route into enterprises. At the start of 2021 the average business faced around 34 social media attacks a month. By June the number was nearer 50, a rise of 47 percent over the half-year.
  3. Office 365 is squarely targeted. Phishing for Office 365 is the biggest email threat facing corporate users. Of the credential theft attacks found in corporate inboxes in the second quarter, 51 percent went after O365 accounts.
  4. Single sign-on accounts are drawing more attention. The report shows attackers increasingly going after accounts used for single sign-on (SSO), with 45 percent of phishing sites aimed at accounts commonly used for it.
  5. Ransomware is changing what emails carry. Payload families shift constantly, and those shifts track ransomware trends closely. Qbot led in the second quarter of 2021, accounting for more than half (54.1 percent) of payloads seen. ZLoader came next but fell steeply from the first quarter, possibly because of its link to the Darkside ransomware group, which said it was shutting down after the Colonial Pipeline attack in May.

Why crypto exchanges and SSO appeal to attackers

LaCour said the findings give a very clear picture of the methods criminals are adopting to break into corporate accounts. As crypto exchanges have become more prominent, he said, they are facing many of the threats that bigger, longer-established financial institutions have dealt with for years, and crypto firms need to be alert to online impersonation and other scams and better prepared to handle them.

The steady growth in SSO attacks, in his view, shows criminals understand that taking over an account used for single sign-on can open up many more secondary accounts that rely on it for authentication. That makes these platforms a very lucrative target, particularly if attackers reach Office 365 at enterprise level. LaCour said countering the trend requires an in-depth approach that brings together technology, user education and operational processes.

  • Attacks over HTTPS continue and account for 82 percent of phishing, which shows that HTTPS on its own is no reason to trust a site.
  • Vishing scams are growing.
  • Abuse of tunnelling services is increasing.
  • Free email accounts such as Gmail and Hotmail are still being misused to launch phishing attacks.

The report is based on data from the hundreds of thousands of attacks against enterprise brands and employees that PhishLabs analysed and mitigated in the second quarter of 2021, which the company used to identify the main trends shaping the threats organisations face.

More press releases