Introducing Cloudflare's 2023 phishing threats report

Cloudflare's First Phishing Threats Report: Attackers Lean on Deceptive Links and Brand Impersonation

Phishing remains one of the most effective attack vectors, with an estimated 90% of successful cyberattacks beginning with a malicious email. While preventing every phishing attempt is nearly impossible, understanding how attackers operate is key to stopping successful breaches. This week, Cloudflare published its inaugural Phishing Threats Report, analyzing email security data from May 2022 to May 2023 to shed light on evolving tactics.

The data is substantial: Cloudflare processed roughly 13 billion emails during that window, blocking approximately 250 million malicious messages. That telemetry is joined by a commissioned survey of 316 security decision-makers across North America, EMEA, and APAC. The report's goal is to help organizations understand how attackers exploit trust in known senders and identify the technical signals that can flag malicious messages.

How Phishing Emails Are Categorized and Detected

Cloudflare's detection engine analyzes a combination of "fuzzy" signals from email headers, body content, images, links, and attachments. The methods include:

• Structural analysis using heuristics and machine learning models for phishing signals
• Sentiment analysis to identify abnormal patterns or shifts in writing style
• Trust graphs that map sending history and flag suspicious partner or brand impersonation

This is supplemented by threat intelligence from Cloudflare's global network, which blocks an average of 140 billion cyber threats per day. The resulting dispositions classify emails as malicious, BEC, spoof, or spam, and the dashboard details the specific threat indicators that triggered the alert.

From May 2, 2022, to May 2, 2023, Cloudflare observed over 30 distinct threat categories. The most frequently seen indicators were:

Deceptive links were the leading category, appearing in 35.6% of detections. These links resolve in a user's default browser and take advantage of the fact that displayed hypertext can be arbitrarily set to a benign-looking URL while the actual destination is malicious. Other significant categories included domain age for newly registered domains used in campaigns, and multiple forms of impersonation:

• Identity deception covers domain look-alikes, spoofing, display name tricks, and abuse of high-reputation web services through domain fronting.
• Credential harvesters lure users into entering login details on decoy pages, handing over account access.
• Brand impersonation uses recognized company names to build a false sense of legitimacy.
• Attachments remain a threat, often containing a call-to-action or executing actions set up by the attacker.

Cloudflare notes that multiple indicators frequently appear in a single email. For example, a March 2023 campaign exploited the Silicon Valley Bank (SVB) collapse by pairing brand impersonation with a deceptive link and a malicious attachment.

The SVB campaign used a DocuSign-themed template with an HTML attachment containing a complex redirect chain four layers deep. The ultimate destination was a compromised WordPress instance with recursive redirection capability—a good illustration that phishing messages are not limited to email; the report also tracks the rise of multi-channel threats across SMS, chat, and social media platforms.

Impersonated Brands and Bypassed Authentication

Between May 2022 and May 2023, Cloudflare observed attempts to impersonate approximately 1,000 different brands. Based on its analysis, 51.7% of brand impersonation attempts used just 20 well-known global brands, with Microsoft the most common target.

A notable campaign detected earlier this year shows how Microsoft is being used as bait. The entire body of the email was a hyperlinked JPEG image—there was no text at all. Any click on the body activated the link, even if the user didn't intend to click a URL. The link appeared benign:

hxxp://www.baidu[.]com/link?url=-yee3T9X9U41UHUa3VV6lx1j5eX2EoI6XpZqfDgDcf-2NYQ8RVpOn5OYkDTuk8Wg#<recipient's email address base64 encoded>

Clicking through that Baidu URL redirected the browser to a compromised legitimate site hosting a credential harvester. The attacker evaded conventional content inspection by embedding all brand details inside the JPEG image instead of in HTML or plaintext.

Cloudflare's detection relied on optical character recognition (OCR) to identify the Office 365 and Microsoft branding within the image, as well as suspicious account lures involving passwords. The technique incorporates several layers of obfuscation:

• Only a JPEG image, hiding the textual cues available without OCR
• A hyperlink embedded across the image, making any click dangerous
• Abuse of Baidu's redirect service to bypass blocklists keyed to reputation
• Hosting the harvester on a high-authority, genuinely compromised domain
• Redirect complexity that defeats URL scanners limited to the first hop

This abuse of trusted redirectors is not isolated. Attackers are progressively exploiting legitimate domains like baidu.com, bing.com, and goo.gl to disguise malicious payloads.

The Limits of SPF, DKIM, and DMARC

A surprising finding in the report is how ineffective standard email authentication methods can be at flagging malicious mail: 89% of unwanted messages passed SPF, DKIM, and/or DMARC checks. The report documents these blind spots in detail.

Authentication standards effectively validate server origins and message integrity, but attackers still deploy methods to appear legitimate while bypassing policy checks. See the full report for specifics on how these standards fall short against modern phishing infrastructure.

Recommendations for a Zero Trust Inbox

Cloudflare recommends extending the "never trust, always verify" model of Zero Trust beyond the network, applications, and users—down to every email message, regardless of whether it appears internal, external, or from a known partner.

The report suggests three concrete measures for the bulletin:

1. Layer multiple anti-phishing controls on top of cloud email. The six-year-old insight that "one successful phish of a supply chain partner's credentials opens your organization up to data loss, credential theft, fraud, and ransomware attacks" remains true; controls must extend to messaging, collaboration, and file-sharing environments that are typically assumed to be closed off.
2. Deploy phishing-resistant multifactor authentication. Not all MFA is equal. Hardware security keys, for example, are among the most robust methods for stopping credential theft before it starts, even if usernames and passwords are compromised.
3. Reduce human error with isolation and input controls. Remote browser isolation can automatically discharge suspicious links, while disabling keyboard inputs on untrusted sites prevents accidental disclosure of passwords in forms designed to harvest credentials.

The complete 2023 Phishing Threats Report is available to download from Cloudflare, along with dedicated recommendations for security teams. Testing against live mail systems can be done through a free, email-based phishing risk assessment offered by the company.