While email is traditionally considered the top way to deliver phishing links, Netskope’s recent report found the threat is coming from “all directions” that include the rise of “next-generation” phishing attacks through fake third-party cloud applications.

Netskope’s cloud and threat report on phishing trends showed that an average of eight out of 1,000 end-users clicked on a phishing link or attempted to access phishing content in the third quarter of 2022.

As employees continue to fall victim to phishing links, the vendor warns organizations should pay attention to delivery methods beyond email. The report revealed that only 11% of the phishing alerts were referred from webmail services such as Microsoft Live, Gmail, or Yahoo Mail, which were overshadowed by personal websites and blogs, especially those hosted on free hosting platforms that now account for 36% of the alerts.

“Business employees have been trained to spot phishing messages in email and text messages, so threat actors have adjusted their methods and are luring users into clicking on phishing links in other, less expected places,” Ray Canzanese, threat research director of Netskope Threat Labs, wrote in a statement.

“While we might not be thinking about the possibility of a phishing attack while surfing the Internet or favorite search engine, we all must use the same level of vigilance and skepticism as we do with inbound email and never enter credentials or sensitive information into any page after clicking a link. Always browse directly to login pages,” Canzanese added.

Netskope Threat Labs identified two primary delivery mechanisms: using malicious links through spam on legitimate blogs and websites; and creating blogs and websites specifically to promote phishing content.

Attackers design fake websites to mimic legitimate login pages and 22% of those websites were hosted on content servers followed by 17% on newly-registered domains, according to the report. “Once users put personal information into a fake site or grant it access to their data, attackers are able to capture usernames, passwords, and multi-factor authentication (MFA) codes,” it warns.

Cloud transformation is changing how businesses work and it’s also shifting how threat actors use phishing attacks to steal data — tricking victims into granting access to their cloud data and resources via fake third-party cloud applications. Netskope Threat Labs calls this an “early trend” but is particularly concerned as access to those applications is ubiquitous and poses a large attack surface.

According to the report, Enterprise end-users granted an average of more than 440 third-party applications access to their Google applications and data, with one organization having around 12,300 different plugins accessing data, which is an average of 16 plugins per user. Additionally, more than 44% of all third-party applications accessing Google Drive have access to either sensitive data or all data on a user’s Google Drive, the report found.

“The next generation of phishing attacks is upon us. With the prevalence of cloud applications and the changing nature of how they are used, from Chrome extensions or app add-ons, users are being asked to authorize access in what has become an overlooked attack vector,” Canzanese wrote. “We expect these types of attacks to increase over time, so organizations need to ensure that new attack paths such as OAuth authorizations are restricted or locked down. Employees should also be aware of these attacks and scrutinize authorization requests the same way they scrutinize emails and text messages.”

Netskope recommends enabling zero-trust principles for least privilege access to data with continuous monitoring; adopting zero-trust technologies such as MFA and single sign-on (SSO) for Application, credential, and identity management; and deploying cloud and Software-as-a-Service security posture management platforms as well as a security services edge (SSE) platform with a secure web gateway (SWG).

Canzanese highlighted the use of remote browser isolation (RBI) as the best example of adopting a zero-trust approach to phishing prevention.

“For any new, unknown, or risky websites, users visit them via a remote browser in an isolated environment. They can see the content on the website and mostly interact with the website like they normally would. But, they can’t enter any information or fill out any forms on the site, thereby preventing them from divulging their usernames and passwords,” he added.