Image-based phishing tactics evolve

While 70% of organizations feel their current security stacks are effective against image-based and QR code phishing attacks, 76% were still compromised in the last 12 months, according to IRONSCALES and Osterman Research.

IT pros are highly aware of emerging types of phishing attacks

93% of IT and security professionals are aware of image-based phishing attacks targeting their organizations, and 79% say the same about QR code attacks. 76% of organizations were still compromised by image-based and QR code phishing attacks over the past 12 months.

While 70% of IT and security professionals feel their current security stack is highly effective at detecting image-based and QR code phishing attacks, less than 6% were able to consistently detect and prevent them from reaching user inboxes.

The research reveals that organizations know of the rising threat posed by image-based and QR code phishing attacks, with 90% of respondents acknowledging that such attacks target their organizations. However, despite this high level of awareness, an alarming 94% of these organizations have seen these emerging attacks bypass their email security stack. This discrepancy indicates an urgent need to enhance email security defenses and employee awareness training.

The research findings also spotlight the pressing need for advanced strategies to combat the increasing volume and complexity of image-based phishing attacks — a threat that extends far beyond the widely-reported technique of QR-code phishing (quishing).

With 60% of surveyed professionals expecting the number, sophistication, and evasiveness of such attacks to worsen soon, this underscores a critical call to action for bolstering organizational defenses against this evolving digital threat.

Organizations lack effective training for cyber threats

What’s more, the research also reveals a significant portion of organizations face challenges related to the human element — with a staggering 76% of organizations conceding that their existing training programs are inadequate in equipping users to recognize and resist these threats.

While QR code attacks have garnered a great deal of media attention as of late, this new research report makes it clear that image-based phishing represents a much broader, more complex challenge. Increasingly, threat actors are using novel techniques to create images that appear to be traditional text-based emails, which allows them to circumvent traditional security solutions.

“In the face of the escalating frequency and complexity of image-based phishing attacks, traditional email security measures are proving to be increasingly insufficient. These sophisticated attacks exploit the nuanced vulnerabilities of human perception and our existing cybersecurity frameworks, making them particularly challenging to detect and prevent,” states Eyal Benishti, CEO of IRONSCALES.

The insights from the Osterman research report serve as a stark reminder of the evolving nature of cybersecurity threats and the imperative for organizations to assess their current email security stack. The findings also underscore the need for an integrated approach that includes advanced detection technologies, comprehensive user training, and a reevaluation of current security strategies to address the nuanced risks presented by image-based and QR code phishing attacks.