3.4 billion credential stuffing attacks targeting financial institutions observed
12% of web application security attacks target financial targets.
LFI accounts for 52% of financial web app security attacks.


It has been revealed that there were more than 4.1 billion security attacks targeting the financial industry in 2020. Akamai announced this in the release of its " Akamai 2021 State of the Internet / Security report: Phishing for Finance ."

According to the report, of the 193 billion credential stuffing attacks observed during the same period, more than 3.4 billion targeted the financial industry, representing a 45% increase year-over-year.

Credential stuffing is a security attack in which attackers combine user IDs and passwords purchased from malicious websites and services to attempt to log in to other login systems. In addition to credential stuffing, there were also security attacks such as SQL injection (SQLi), local file inclusion (LFI), and cross-site scripting (XSS) to steal user information.

A total of 6.2 billion web application security attacks using this method were observed in 2020, of which 700 million, or 12%, targeted the financial industry. This represents a 62% increase compared to the previous year. Notably, LFI, which accounts for a small percentage of all web application security attacks, accounted for the largest proportion of web application attacks targeting the financial industry, reaching 52%.

Distributed Denial of Service (DDoS) attacks targeting the financial industry have increased by 93% over the past three years, starting in 2018. This means that attackers' goal is to disrupt the services and applications essential for daily operations.

“The rise in credential stuffing attacks is directly related to the rise of phishing attacks that threaten the financial services industry,” said Steve Ragan, Akamai security researcher and author of the State of the Internet / Security report. “Criminals are using a variety of methods to combine credentials, and phishing is a key tool. They are targeting customers and employees of banking services companies, creating a massive potential victim base.”

Akamai partnered with Threat Intelligence and Management (WMC) Global to produce the report. The two companies analyzed two phishing kits, 'Kr3pto' and 'Ex-Robotos'.

The Kr3pto phishing kit, which targets financial institutions and their customers via SMS, has been observed to have defrauded 11 UK companies across over 8,000 domains since May 2020. WMC Global tracked over 4,000 campaigns linked to Kr3pto, which targeted victims via SMS messages over a 31-day period in Q1 2021.

Ex-Robotos is a phishing kit that has set a new benchmark in corporate credential phishing. According to data from the Akamai Intelligent Edge Platform, over 220,000 attacks were made against API IP addresses over a 43-day period. Traffic to these addresses peaked on January 13 and February 5, 2021, with tens of thousands of attacks per day.

“The Kr3pto and Ex-Robotos phishing kits are just a few of the many targeting businesses and their customers,” said Jake Sloane, WMC Global Senior Threat Researcher. “With the rise of remote work and the use of mobile devices in corporate environments, we’ve seen a rise in smishing attacks. Criminals are also targeting their victims regardless of their location. It’s important to remember that employees are customers, too.”