6 Shocking Advanced Phishing Attacks in 2024

In 2024, cybercriminals employed cutting-edge techniques to execute some of the most alarming phishing attacks seen to date. These attacks, targeting employees through highly sophisticated and novel methods, led to significant financial and operational damages for global corporations.

Below, we detail the six most shocking phishing examples, showcasing how human vulnerabilities can be exploited despite advanced security systems.

AI-Driven Voice Cloning Scams (Vishing)

In a chilling example of how advanced AI is being misused, attackers cloned the voice of a senior executive from a global pharmaceutical firm. Employees received urgent calls from the "executive," demanding immediate wire transfers for a fake acquisition deal.

The cloned voice was indistinguishable from the real person, complete with accent and tone. The company only discovered the scam after losing $35 million.

Smishing Parcel Delivery Scams

A surge in smishing scams targeted employees of a logistics company. Fraudsters impersonated Evri and other courier services, sending text messages claiming that delivery issues needed immediate attention.

Employees, believing the texts to be legitimate, clicked links and entered credentials on fake sites. This led to unauthorized access to the company's internal systems and the exfiltration of sensitive customer data. The breach caused a $10 million class-action lawsuit against the company.

Quishing Attacks with Fake Event QR Codes

During a high-profile tech conference in Silicon Valley, attendees, including employees of Fortune 500 companies, received brochures containing QR codes phishing.

Scanning these codes led users to malicious websites that mimicked their company's login portals. Attackers stole thousands of credentials and gained access to internal networks, causing $15 million in damages from unauthorized cryptocurrency transactions.

Callback Phishing Attack on Financial Firm

A targeted callback phishing attack exploited employees at a major financial services company. Attackers impersonated IT support staff and claimed there was an urgent security update needed.

Employees called back as instructed and unknowingly disclosed their credentials. This resulted in the unauthorized transfer of $20 million and a temporary freeze on trading activities, which shook investor confidence.

Learn more about callback phishing on our blog “What is Callback Phishing?”

MFA Fatigue Exploitation

Cybercriminals bombarded employees at a multinational energy company with a barrage of MFA push notifications at odd hours. Exhausted and frustrated, one employee finally approved the request to stop the notifications.

This gave attackers access to critical infrastructure systems, disrupting operations for 72 hours and causing an estimated $50 million in operational losses.

Pretexting at a Global Retail Giant

A retail giant faced a clever pretexting attack where an attacker posed as the company’s CFO and emailed a mid-level finance employee. Using insider information obtained through social media and earlier phishing attempts, the attacker convinced the employee to transfer $12 million to an offshore account for a "confidential acquisition." The fraud was only uncovered during a routine audit.

Lessons Learned

These attacks highlight the sophisticated methods attackers use to exploit human vulnerabilities, from emotional manipulation to AI-based deception. Companies must:

• Invest in advanced cybersecurity awareness training.
• Utilize multi-layered security systems (beyond just MFA).
• Encourage employees to verify requests, especially financial ones, via trusted secondary channels.

Takeaway: Even the most robust technical defenses can fail without an alert and well-trained workforce.

How Keepnet’s Human Risk Management Protects Against Advanced Phishing Attacks

Keepnet’s Human Risk Management solution provides a comprehensive framework for organizations of all sizes to continuously protect their employees and assets against advanced phishing threats. Here’s how it addresses the six types of phishing attacks highlighted:

1. AI-Driven Voice Phishing Simulation (Vishing): Keepnet leverages AI to create safe voice phishing (vishing) simulations for organizations, helping their employees detect and respond to vishing attacks. Tailored training content raises awareness, while nudging techniques reinforce secure behaviors to mitigate this evolving threat.
2. Smishing Simulation: Keepnet’s smishing simulation and training modules, employees learn to identify fake text messages and avoid sharing sensitive information via malicious links.
3. Quishing Attack Simulation: Keepnet provides QR phishing simulations that analyze user behavior when interacting with QR codes, helping to identify risks. Tailored training modules educate employees about QR-specific threats, while nudging techniques reinforce secure behavior to mitigate these risks effectively.
4. Callback Phishing Attacks: Keepnet combines email phishing and voice phishing (vishing) to simulate callback phishing, enabling organizations to analyze user behavior, train employees for security awareness, and nudge them to embed secure behaviors against this threat.
5. MFA Phishing Simulations: Keepnet provides MFA phishing simulations that analyze risky behavior by exposing employees to realistic scenarios, helping organizations identify vulnerabilities. Tailored training modules prepare employees for MFA-related threats, while nudging techniques reinforce secure behaviors in real time, reducing the likelihood of fatigue-based exploitation.
6. Pretexting Phishing: Keepnet’s pretexting phishing simulation tool, analyze risky behavior and provide tailored training modules. Nudging techniques reinforce best practices, ensuring employees develop a habit of cross-checking unusual requests, especially involving financial transactions.

Keepnet: Comprehensive Protection Against Social Engineering Attacks

Keepnet is unique because it covers all advanced phishing threats in social engineering attacks to protect organizations of any size.