March Hackness 2021: The Pandemic’s Phishing Playbook
As the Annual March Hackness phishing tournament heads into its regional rounds, the bracket is already proving that threat actors are closely following real-world business trends. The usual suspects—Microsoft and Google—remain dominant as the most-impersonated brands, a position they’ve held for years. Most recently, researchers uncovered a sophisticated Microsoft 365 campaign targeting financial departments and executive assistants.
But the surprises come from the newcomers. The World Health Organization, a daily fixture in pandemic news, has earned a Cinderella run. Target saw online sales surge by $10 billion last year, and DocuSign rode a nearly 50% revenue jump on the back of remote work—both now find themselves among the top impersonated brands.
Notable exits include PayPal, the 2019 bracket champion, which was knocked out in the first round. In the phishing world, that’s a compliment: it means fewer attackers are spoofing the brand. Meanwhile, the Sweet 16 sets up marquee matchups, with Twitter taking on the Duke-like pedigree of Microsoft, and an early heavyweight bout between Facebook and Amazon. Apple looks positioned for a deep run, and the WHO may yet reach the final.
Email Authentication Is Not the Silver Bullet
All this impersonation activity begs a practical question: do standards like SPF, DKIM, and DMARC actually stop spoofing-based phishing? Based on over 22 million blocked attacks in the past year, the short answer is no.
These standards serve a legitimate purpose—validating server and tenant origins, protecting message integrity, and enforcing policy. But security teams should understand their limitations:
- Anyone can set up emails that pass email authentication.
- Email authentication does not inspect content.
- Email authentication does not protect against look-alike domains.
- Email authentication does not protect against compromised domains.
- The vast majority of organizations and domains do not use email authentication.
- Email authentication can be difficult to set up properly.
| DMARC (Domain-based Message Authentication, Reporting and Conformance) |
||
|---|---|---|
| Purpose | Providing policy enforcement and reporting for SPF and DKIM Stipulating what policy to follow if an email doesn’t pass SPF or DKIM authentication (e.g. reject/delete, quarantine, no policy/send) Reporting function allows domain owners to who is sending email on their behalf |
|
| Best for: | Protecting against spoofing of your own domain and brand abuse (Does not prevent spoofing of another brand’s domain.) |
|
| Limitations | Does not prevent spoofing of another brand’s domain Does not prevent look-alike email, domain or display name spoofing Domain owners specify what percentage of mail DMARC policies applies to; application percentages of less than 100% are virtually meaningless Does not protect against attacks using “validated” emails with embedded URLs, malicious payloads or attachments |
|
