Cloud-based safety threats are rising at a sooner price than ever, as risk actors discover new and revolutionary methods to push malware (opens in new tab) by the novel know-how. 

Netskope’s newest Cloud & Menace Report: International Cloud and Net Malware Developments paper discovered greater than half (55%) of all HTTP and HTTPS malware downloads got here from cloud apps, up from 35% for a similar interval a yr earlier than. 

That makes it greater than a 50% soar year-on-year.

Malicious apps multiplying

The rise is because of a rise in folks downloading malware from widespread enterprise cloud purposes, Netskope additional claims. Microsoft’s OneDrive is seen as the preferred enterprise app “by a large margin”. Moreover, the variety of purposes with malware downloads additionally continued rising, with Netskope figuring out 261 totally different malicious apps in Q1 this yr. 

To make issues worse, malware delivered over what’s thought of “dangerous internet classes” makes up however a tiny portion of whole internet malware downloads, with nearly all of the downloads being unfold out over totally different websites. Content material supply networks (CDNs) are literally used probably the most, with a market share of seven.7%.

Normally, 5 in 1,000 enterprise customers tried to obtain malware in Q1 2023, with new variants taking over nearly three-quarters (72%) of these downloads. What’s extra, nearly 10% of all downloads began with a search engine question, as risk actors weaponize information voids and web optimization poisoning for queries which have only a few outcomes. “This represents simply one among many social engineering strategies that attackers are accelerating,” the researchers say.

Lastly, social engineering reigns supreme as the important thing malware supply approach with electronic mail, collaboration apps, and chat apps, are being leveraged to trick folks into downloading malware. Trojans are the preferred malware sort with 60% of all downloads. Phishing downloads took up 13%.

• Here is our listing of the perfect endpoint safety (opens in new tab) companies proper now