HR and IT related emails are the top choices for phishing scams

KnowBe4’s Q1 2024 global phishing report finds that HR and IT related email subjects account for more than 42% and 30% of top phishing email subjects respectively.

KnowBe4 has published the results of its Q1 2024 top-clicked phishing test report. The results include the most common email subjects clicked on in phishing tests, reflecting the persistent use of HR or IT-related business email messages that captivate employees’ interests.

Phishing emails continue to be one of the most common methods for executing cyberattacks on organisations worldwide. KnowBe4’s 2023 Phishing by Industry Benchmarking Report reveals that nearly one third of users are susceptible to clicking on malicious links or complying with fraudulent requests. As a result, cybercriminals take advantage of this vulnerability and leverage the innovative tools available to them, such as AI, to come up with increasingly sophisticated messages to outsmart users. These bad actors tailor phishing email strategies to appear more legitimate in their requests and trick employees by inciting an emotional response and urgency to click on a malicious link or download an infected attachment.

HR-related phishing attacks take the top spot at 42%, a trend that has persisted for the last three quarters, followed by IT-related phishing emails at 30%. Phishing emails from HR or IT departments that prompt dress code changes, tax and healthcare updates, training notifications and other similar actions are effective in deceiving employees as they can affect a user’s work, evoke an immediate response and can cause a person to react before thinking about the validity of the email.

The KnowBe4 phishing report this quarter also noted more personal phishing email attacks, such as tax, healthcare and ApplePay, that could affect users' sensitive information. These types of attacks are effective because they cause a person to react to a potentially alarming topic and engage to protect their private information before thinking logically about the credibility of the email.

“KnowBe4’s report shows that cybercriminals are becoming increasingly tactical in exploiting employee trust by using HR-related phishing emails due to their seemingly legitimate source,” said Stu Sjouwerman, CEO of KnowBe4. “Emails coming from an internal department such as HR or IT are especially harmful to organisations since they appear to be coming from a trusted source and can convince employees to engage quickly before confirming their legitimacy, exposing the company to security vulnerabilities. A well-trained workforce is therefore crucial in building a strong security culture and serves as the best defence in safeguarding organisations against preventable cyberattacks.”

Fortinet introduces advanced FortiOS features to safeguard networks against quantum computing...
Network disruptions cost UK businesses millions, prompting renewed focus on connectivity and...
Darktrace bolsters its cybersecurity capabilities with the acquisition of network solution leader...
AI is widely adopted but lacking governance in UK enterprises. Only 7% have comprehensive...
The cautious response to AI in cybersecurity highlights privacy and oversight concerns despite...
Resilience collaborates with CrowdStrike and AWS to enhance cyber risk management, transforming...
A study by Scalefusion exposes security risks due to unmanaged devices in UK companies.
Palo Alto Networks teams with UK's Ministry of Justice to bolster digital security, optimize...