Editorial & Advertiser disclosure

Global Banking and Finance Review is an online platform offering news, analysis, and opinion on the latest trends, developments, and innovations in the banking and finance industry worldwide. The platform covers a diverse range of topics, including banking, insurance, investment, wealth management, fintech, and regulatory issues. The website publishes news, press releases, opinion and advertorials on various financial organizations, products and services which are commissioned from various Companies, Organizations, PR agencies, Bloggers etc. These commissioned articles are commercial in nature. This is not to be considered as financial advice and should be considered only for information purposes. It does not reflect the views or opinion of our website and is not to be considered an endorsement or a recommendation. We cannot guarantee the accuracy or applicability of any information provided with respect to your individual or personal circumstances. Please seek Professional advice from a qualified professional before making any financial decisions. We link to various third-party websites, affiliate sales networks, and to our advertising partners websites. When you view or click on certain links available on our articles, our partners may compensate us for displaying the content to you or make a purchase or fill a form. This will not incur any additional charges to you. To make things simpler for you to identity or distinguish advertised or sponsored articles or links, you may consider all articles or links hosted on our site as a commercial article placement. We will not be responsible for any loss you may suffer as a result of any omission or inaccuracy on the website.

Home > Top Stories > IMPERVA RESEARCHERS GO UNDERCOVER TO STUDY TACTICS OF PHISHING HACKERS

IMPERVA RESEARCHERS GO UNDERCOVER TO STUDY TACTICS OF PHISHING HACKERS

Published by Gbaf News

Posted on July 28, 2017

6 min read

Last updated: January 21, 2026

Investors analyzing water scarcity impacts on companies - Global Banking & Finance Review — Image depicting investors assessing the impact of drought on companies and exploring water management solutions. This relates to the article's discussion on the financial implications of water scarcity.

Study reveals typical account takeover time, most sought after data, as well as lazy habits of attackers

Imperva, Inc. (NASDAQ: IMPV), committed to protecting business-critical data and applications in the cloud and on-premises, today released its research report, “Beyond Takeover – Stories from a Hacked Account.” The report reveals common patterns in phishing attacks and how hackers find and use data in compromised accounts.

To discover details about compromised credentials, Imperva researchers went undercover by creating several fake user accounts, including email and file sharing accounts with Google and Dropbox. Once the so-called honey pot accounts were active, the researchers deployed techniques to lure in the criminals and tracked them over the span of nine months.

The research report reveals details of hacker techniques and behaviours, including how long it takes from takeover to exploitation, what the attacker looks for in the hacked account, which decoys attract their attention, and what security practices they use to cover their tracks.

Among the most interesting findings are:

Business data is highly sought.Twenty-five percent of the phishers looked at email subject lines related to business such as those that included the words financial data, customer database or supplier details.
Attackers aren’t quick to act. More than 50 percent of the accounts were accessed 24-hours or more after the credential takeover. The result is a brief window where if the attack is suspected, a quick password change results in a 56 percent chance of preventing an account takeover.
Attackers access content manually not through automated tools. Seventy-four percent of the first alerts were triggered within three minutes of account penetration. This timing indicates that the attacker accessed bait documents while exploring the inbox.
Less than half of the leaked credentials were exploited by attackers. One explanation for this could be that attackers have access to so much data they don’t have enough time to explore it all.

Attacker Behaviour

The report revealed common behaviours of cybercriminals by delving into how attackers cover their tracks. For example, to remain anonymous, attackers should destroy evidence of their presence in accounts by erasing contaminated logins and messages. Yet it was surprising that 83 percent of the attackers did little to cover their tracks. Of those who did cover their tracks, 15 percent erased new sign-in alerts from the email inbox, but usually forgot to delete them from the email trash container.

The research also demonstrated phishers are no more careful than their victims. The Imperva researchers planted various traps within the accounts and most attackers did not hesitate to click the links and open documents – blithely doing so without taking precautionary measures such as using a sandbox or anonymity service. This also means that with a bit of detective work the cybercriminals can be tracked.

“By studying cyberattackers, we’ve learned many things including that most attackers don’t bother to cover their tracks, which means they leave evidence behind,” said ItsikMantin, head of data research at Imperva. “Furthermore, if we can quickly detect an attack, we then know that swift remediation including a simple password change significantly reduces the odds of a successful attack. This lesson proves the value of incorporating threat-intelligence and breach detection solutions that quickly detect and help mitigate this risk.”

Study reveals typical account takeover time, most sought after data, as well as lazy habits of attackers

Imperva, Inc. (NASDAQ: IMPV), committed to protecting business-critical data and applications in the cloud and on-premises, today released its research report, “Beyond Takeover – Stories from a Hacked Account.” The report reveals common patterns in phishing attacks and how hackers find and use data in compromised accounts.

To discover details about compromised credentials, Imperva researchers went undercover by creating several fake user accounts, including email and file sharing accounts with Google and Dropbox. Once the so-called honey pot accounts were active, the researchers deployed techniques to lure in the criminals and tracked them over the span of nine months.

The research report reveals details of hacker techniques and behaviours, including how long it takes from takeover to exploitation, what the attacker looks for in the hacked account, which decoys attract their attention, and what security practices they use to cover their tracks.

Among the most interesting findings are:

Business data is highly sought.Twenty-five percent of the phishers looked at email subject lines related to business such as those that included the words financial data, customer database or supplier details.
Attackers aren’t quick to act. More than 50 percent of the accounts were accessed 24-hours or more after the credential takeover. The result is a brief window where if the attack is suspected, a quick password change results in a 56 percent chance of preventing an account takeover.
Attackers access content manually not through automated tools. Seventy-four percent of the first alerts were triggered within three minutes of account penetration. This timing indicates that the attacker accessed bait documents while exploring the inbox.
Less than half of the leaked credentials were exploited by attackers. One explanation for this could be that attackers have access to so much data they don’t have enough time to explore it all.

Attacker Behaviour

The report revealed common behaviours of cybercriminals by delving into how attackers cover their tracks. For example, to remain anonymous, attackers should destroy evidence of their presence in accounts by erasing contaminated logins and messages. Yet it was surprising that 83 percent of the attackers did little to cover their tracks. Of those who did cover their tracks, 15 percent erased new sign-in alerts from the email inbox, but usually forgot to delete them from the email trash container.

The research also demonstrated phishers are no more careful than their victims. The Imperva researchers planted various traps within the accounts and most attackers did not hesitate to click the links and open documents – blithely doing so without taking precautionary measures such as using a sandbox or anonymity service. This also means that with a bit of detective work the cybercriminals can be tracked.

“By studying cyberattackers, we’ve learned many things including that most attackers don’t bother to cover their tracks, which means they leave evidence behind,” said ItsikMantin, head of data research at Imperva. “Furthermore, if we can quickly detect an attack, we then know that swift remediation including a simple password change significantly reduces the odds of a successful attack. This lesson proves the value of incorporating threat-intelligence and breach detection solutions that quickly detect and help mitigate this risk.”