Phishing Bait Attacks Use Gmail as Main Platform, Researchers Find

Researchers from Barracuda have discovered that more than 90% of all phishing bait attacks come from Gmail accounts, making them more likely to bypass security solutions because they're arriving from a reputable source.

Bait phishing attacks are different from the general phishing attacks we're used to. They’re actually a subset of phishing attacks with a very precise purpose, even if it seems like we're just receiving them for no reason at all.

How many times have you seen an email with no content? Or maybe just a few words, but no links or attachments? Messages like these are just an annoyance for the people who receive them, but they can be valuable tools for the attackers who send them. Tricking people into revealing personal information is not their immediate goal. They're scouting the terrain before the main attack.

Even an empty email that arrives in your account tells the attackers that it's a valid email address and that it likely bypassed any security solutions. And because more than 90% of emails come from Gmail accounts, the attackers also can enable the "read receipt" feature that tells the sender that an email has been opened. And just like that, criminals now know the email is valid, someone is using it, and the email passed through several security layers.

"Moreover, to avoid being detected, the attackers typically use fresh email accounts from free services, such as Gmail, Yahoo, or Hotmail, to send the attacks," said the researchers. "Attackers also rely on a low volume, non-burst sending behavior in an attempt to get past any bulk or anomaly-based detectors."

"While the number of bait attacks is still low overall, they are not unusual. Based on analysis by Barracuda researchers, just over 35% of the 10,500 organizations analyzed were targeted by at least one bait attack in September 2021, with an average of three distinct mailboxes per company receiving one of these messages," they added.

Even if these emails are less common than actual phishing attacks, they are still a threat. Make sure to mark them as spam when you receive them, and make a habit of not opening emails or attachments from people you don't know.