2025年网络威胁情报报告 Cyber Threat Intelligence Report

2025

CyberThreatIntelligenceReport

TableofContents

01ExecutiveSummary&Introduction

07

ThreatLandscapeOverview

25

HumanRiskFindings

28

Campaigns,toolingand

environmentsresearch

43StrategicGuidance

ExecutiveSummary

WhileAI-generatedvoiceandvideodeepfakesdominated

headlinesanddiscussionsinthecybercommunityin2025,theseattacksaccountedforafractionofthethreatsthat

bypassedfiltersandactuallyreachedemployees.Thevast

majorityofattacksleveragedmoretraditionalimpersonationanddeceptiontechniquesthathavebeenupdatedtotrickfiltersandslideintonewcommunicationenvironments,

includingsocialmedia.

Sometimesdevelopmentsinthethreatlandscapewere

enhancedbyAIandsometimesnot.Theireffectiveness

wasfueledbyfamiliarity,notvisiblyslickdeceptionand

sophistication.Thenewgenerationofattacksimitated

normalbusinessprocesses,crediblebrands,trustedtoolsandeverydaycommunicationpatterns.

Thisreportrevealsthequantityandqualityofthreatsthatmattermost:theonesthatbypassfiltersandaffectreal

people.Thisintelligencewillhelpyoudevelopyourtrainingandmanageyourhumanriskmoreeffectively.Thisreport’sdatasetisbasedonmillionsofuser-reportedemailsthat

bypassedfiltersin2025.

3keydevelopments

•First,attackersareusingAItoimproveclassicphishingtechniqueswithcleanerlanguage,moreconvincing

formattingandmorebelievableworkflowmimicry.

•Second,adversary-in-the-middle(AitM)phishingkits

havebecomeeasiertodeployandarebecomingmore

widelyadopted.Thesetoolkitsinterceptloginsinrealtime,forwardtheauthenticationtothelegitimateservice,andcapturesessiontokensinadditiontopasswords.AitM

attackscancircumventMFA.

•Third,socialengineeringisincreasinglyexpandingbeyondemailenvironmentsandmovingintosocialplatforms,

recruitmentchannelsandothercommunicationlayersthatshapeprofessionalidentity.

Fluentphish:Flawlessgrammar,livechatsandAitMtoolkits

GenerativeAIraisedthequalitybaselineforphishing

content.Manyphishingemailsarenowpolishedand

grammaticallyperfect,underminingtheclassic“lookfor

typos”advice.Today’sthreatsmightevenreadmorefluentlythanlegitimatecorrespondence.

Recruitmentandaccountsuspensionthemedsocial-mediaaccounttakeoversemergedwithnoveltacticstohijackMetabusinessaccountsthroughbrowser-in-the-browserandlive-chattechniques.Thesecampaigns

underscorehowprofessionalidentities—notjustcredentials—arebeingmonetized.

Phishing-resistantMFAremainsvital,yettheriseofadversary-in-the-middletoolkitscapableofsession-tokentheftshows

thatidentityprotectionmustevolvebeyondtraditionalMFA

prompts.OrganizationscannolongerrelysolelyonpasswordsorSMScodestomaintainaccountintegrity.

Trustedroutines,trustedbrands

Byblendingintolegitimateworkflows,thirdparties,andinfrastructure,attackersachieveafalsesenseoftrust.In2025,theychangedtheirtacticsandadoptedsomenewtechnologiestodoexactlythat,butmoreeffectively.

•Consumerwebmailcontinuestodominate,with

accountingforroughlyone-fifthofallmalicioussenders.

•Themisuseoflegitimateserviceswasalsoprevalent

throughoutthefirsthalfoftheyear,with,forexample,themisuseofSalesforcetripling—from0.6%inJanuary

to1.8%,signalingincreasingattackerpreferenceforrecognized,trusteddeliverypathsthatexploitbothtechnologicalandhumanblindspots.

•Attachment-basedtechniquesdiversifiedasmaliciousSVGattachmentssurged,growing50-foldcomparedto2024,whilemaliciousQRcodes--onceabreakouttrend--now

appearinlessthantwopercentofmaliciousemails.

UpdatingYourSecurityAwarenessandDefensePlaybook

Overall,thefindingsimplyasteadyshifttowardstealth,

automation,andtoken-basedcompromise.Defenders

shouldassumethatattackerscanbypasscommonfiltersandinsteadfocusondetectinganomaliesafterlogin,bindingtokenstodevices,andshorteningsessionlifetimes.

Thedevelopmentoferror-freephishingmessagesreinforcestheneedforbehavioraltrainingthatteachesemployees

toquestionroutine,notjusturgencyanderrors.Awarenessprogramsshouldemphasizeroutine-lookingluresover

sensationalones,whiletechnicalteamsimplementtoken-centricincidentresponseandphishing-resistantMFA.

Finally,everyorganizationshouldreinforcea“Pause→Verify→Act”culturethattreatsordinaryrequestswiththesame

cautionreservedforhigh-urgencyscams.

Together,thesebehavioralandtechnicalsafeguards

transformhumansintoanearlywarningsystemratherthananentrypoint.

Topentitiesimpersonated

Topemotionsexploited

01

Urgency

Curiosity

Trust

02

HumanResources

Approval

Reward-seeking

03

Supplychain3rdparties

PhishingemailscreatedwithAImirrortheoverallthreat

landscape.*Traditionalsigns

liketyposorgrammarmistakesarefarlesssignificanttoday

BackinOctober2023,the

occurrenceofQRcodesin

maliciousemailswentfrom

negligibletoover20%.InH12025,theyonlyshowedupinlessthan2%ofmaliciousemails.

AttachmentTypesbyPopularityin2025vs.2024

25%

15%

10%

5%

0%

In2025,SVGattachmentssawa50-foldincreasein

volumecomparedto2024

.pdf.html.svg.docx.eml

Sincelate2024threatactorshaveincreasingly

abusedSalesforce’smailingservicetosendphishing

emailsfrom:

itsshareofalldomainsusedinphishingrosefrom0.6%inJanuary2025to

1.8%inJune2025

wasoftenusedtodeliverrecruitment-

themedthreatstargetingbusinesssocialmediaaccounts

Linkshortenerpopularity

bit.ly

.t.cocutt.lyshorturl.al

Documentsharingpopularity

Sharepoint.DropboxAdobeDocusign

Twittershortlinksremainthemostpopularlinkshorteningservice

usedinphishing

Dropboxalsoremainsasthe

mostpopulardocumentsharingserviceusedinphishing

600%

Increaseinsocialmedialinksseeninphishingemailssince2023.*Mostlyduetoincreasinguseof

compromisedbusinessemails,astheirsignaturesoftencontainlinkstosocialmedia.

170%

Increaseinpopularityoflinksleading

to

G

inphishingemails.

Threatlandscapeoverview6CyberThreatIntelligenceReport

Introduction

Structuredfordifferentdecisionlevels

anddepth,thisreportstartswithaThreat

LandscapeOverviewsectionthatprovidesTactics,TechniquesandProcedures(TTPs)

andreal-worldexamplesthatdefenders

andanalystscantranslateintodetections,

awarenessplaybooks,andhardeningtasks.HumanRiskFindingsdetailshowendusersperformagainstrelevantthreats,giving

securityawarenessleadersbenchmarks,targets,andresourcingsignals

Finally,TheCampaigns,Tooling,and

EnvironmentResearchsectioncovers

Microsoftvs.Googleplatformnuances,

killchain-styledissectionoftwoseparateMetaimpersonationcampaigns,analysisofGenAI-enabledlures,and2025phishingkitstrends,offeringpractitionersthedeepdivesneededtoanticipateattackermoves,tailorcontrols

andtraining,andpreparecountermeasures.

ThereportisbasedonHoxhunt’sglobal

phishingcampaigndata,includinghundredsofthousandsofattacksbetweenJanuary

andJune2025,referencedagainstdata

fromprioryears.Thedatasetconsistsof

user-reportedemailsthatbypassedfilters;

thus,verystealthysuccess(noreport)is

underrepresented,whilealotofhigh-volumebulkphishingblockedatthegatewayis

excluded.Instead,thereporthighlights

whatslipsthroughdefencesandshowcaseshowattackersareconstantlyadaptingtheiroperations.

Abouttheauthors

Hoxhuntistheleadingplatformforhumancyber-riskmanagement.

Oursolutiongoesbeyondsecurity

awarenesstodrivebehaviourchange

andmeasurablylowerhumancyber-

risk.CombiningAIandbehavioural

science,wecreateindividualized

trainingmomentspeoplelove.We

workwithleadingglobalcompanies

suchasAirbus,IGT,DocuSign,Nokia,

AES,Avanade,andKärcherand

partnerwithglobalcybersecurity

companiessuchasMicrosoft

andDeloitte.

Hoxhunt’sThreatOperationsteam

consistsofthreatanalysts,threat

intelligenceanalystsanddata

scientiststaskedwithprocessing

threatdatareportedtoHoxhunt.

Onamonthlybasis,over500,000

emailthreatsarereportedtousby

endusers.Becauseourendusers

manuallyreporttheemails,ourdata

onlyconsistsofthreatsthathave

managedtobypassemailspamfilters.

ThisdataisanalyzedbytheThreat

Operationsteamandcombined

withotherdatasourcestocreate

actionableintelligence.

Threat

LandscapeOverview

01

HumanRiskFindings8CyberThreatIntelligenceReport

TopSocial

EngineeringTactics

Popularcampaigns

Thissectiondivesintothemostpopularsocialengineeringtechniquesandoffersreal-lifeexamplesofsomeofthemostcommonphishing

campaignsofH12025.

↑Figure1.Exampleofavoicemail-themedMicrosoftimpersonation.

Age-oldtacticsremaineffectiveandhave

continuedtoevolveoverthepastyear,withthemessuchasMicrosoftimpersonationsstillamongthelargestcampaignsobservedbyHoxhunt’sanalysts.Attackerscommonlyutilizeasecurityalerttheme,exploitingurgency,orclaimanewvoicemail

transcriptisavailable(Figure1),toexploitcuriosity.

Attackersmimicfamiliarworkflowsandexploit

urgencyandauthority.

Topentitiesimpersonated

》Microsoft

》Humanresources

》Supplychainthirdparties

Topemotionsexploited

》Urgency》Curiosity

》Trust

》Approval

》Reward-seeking

Gainingaccessto

organizationalaccountsremainsamaingoalforthreatactors.

»MicrosoftimpersonationsarestillamongthelargestcampaignsobservedbyHoxhunt’sanalysts.

HumanRiskFindings9CyberThreatIntelligenceReport

FilesharethemedphishinghasalsoremainedwidespreadthisyearwithDocusignasthemostimpersonatedandmisusedservice(Figure3).Specificsocialengineeringtechniquesvary,buttheendgoalisthesame:stealingtherecipient’sorganizationalcredentials,exploitingbothcuriosityandthefamiliarityofeverydayworkflows.

Threatactorsimpersonatearangeofparties,likeHR,suppliersandserviceprovidersinfileshareattacks.Insomeofthemostpopularcampaignsof

2025,attackersimpersonatedhumanresources,claimingtosharealinktoalistofsalaryincreases(Figure

2),oraskingtherecipienttoreviewadocumentregardingbonus

distributionplans(Figure3).The

socialengineersareexploitingtherecipient’sdesiretoberecognizedandrewarded,stirringcuriosity,andleveragingtrustinanorganizationalauthorityfigure.

»Insomeofthemostpopular

campaignsof2025,attackers

impersonatedhumanresources,claimingtosharealinktoalistofsalaryincreases

↑Figure3.HRimpersonationwhereamaliciousQRcodeissharedviaDocusign,atrustedthird-partyservice.

↓Figure2.HRimpersonationutilizingasalarylisttheme.

HumanRiskFindings10CyberThreatIntelligenceReport

Threatactorsalsoimpersonatesuppliers,partners,andserviceproviderstoshare

maliciousfilesandmanipulateinvoicing,deliverydetails,orcontractterms.Supplychainfraudphishingisoftensentfromfreeemailaddressesorlook-a-likedomains,andemailsalsooriginatefromcompromisedorganizationalemailaddresses(Figure4).Thesetypesofphishingemailsoftenincludemaliciousattachmentswithembeddedlinksleadingtocredentialharvesters.

WhensharingfilesorsendingotherfraudulentemailsfromlegitimateemailaddressesofSMBs,orevenfromlook-a-likedomains,attackersareexploitingtrustandthefamiliarityofeverydayworkflows.

↑Figure4.Remittance-themedphishingemailsentfromacompromisedaccount.

»Supplychainfraudphishingisoftensentfromfreeemailaddressesorlook-a-likedomains,andemailsalsooriginatefromcompromised

organizationalemailaddresses

HumanRiskFindings11CyberThreatIntelligenceReport

↑Figure5.Fakeemailthreadimpersonatingtherecipient’sCEOandBakerMcKenzie.

Supplychainattacksarenota2025novelty(

wewroteabouttheminearly2024,for

example

),buttheyremainapopularthemeusedinmajorcampaigns.Perhapsevenmorenoteworthyin2025istheobservedincreaseofthefakeemailchaintechnique.Threat

actorscraftemailthreadsthatappeartobeapartanongoingconversations,making

theircall-to-action,oftenrequestingthepaymentofalargeinvoice,seemmorecredible.Inonecampaignthatusesthistechnique,attackersattemptedtoconvincetherecipienttoexecutealargefinancialtransactionbyclaimingtherewasanunpaidinvoiceand

impersonatingtherecipient’sCEO(Figure5).

HumanRiskFindings12CyberThreatIntelligenceReport

GenerativeAIandPhishingVisuals

Lately,thevisualoutlookof

commonbulkphishinghasshiftedfromminimal,unformattedemailstomorerefinedtemplateswith

brandingelementsandstructuredlayouts,withtimingthataligns

withtheincreasingqualityand

availabilityofgenerativeAItools.

Arepresentativeshiftinvisual

presentationistheMicrosoft

impersonationframedasa“full

mailbox”alert,aconventionallure.Theneweremailtemplate(Figure6)looksslickerwithbranding

elementsandfootersandis

probabletobeAI-generated,whileanolderphishingemail(Figure7)isplainwithminimalgraphics.

→Figure6.Microsoftimpersonationutilizingasecurityalertthemefrom2025.

»ArepresentativeshiftinvisualpresentationistheMicrosoftimpersonationframedasa“fullmailbox”alert,aconventionallure.Theneweremailtemplatelooksslicker

withbrandingelementsandfootersandisprobabletobeAI-generated,whileanolderphishingemailisplainwithminimalgraphics.

HumanRiskFindings13CyberThreatIntelligenceReport

Althoughneweremailslookmorepolished,improvedvisualsdonotnecessarilymakeacampaignappearmorelegitimate.Infact,thesimpler“fullmailbox”alertfrom2023(Figure7)morecloselymirroredgenuineMicrosoftnotifications(Figure8),appearingmoreauthenticthanthenewer,moreelaborateversion(Figure6).

↑Figure7.Microsoftimpersonationutilizingasecurityalert

themefrom2023.

↑Figure8.RealMicrosoftsecurityalertnotificationfrom2025.

»Althoughneweremailslookmorepolished,improvedvisualsdonotnecessarilymakea

campaignappearmorelegitimate.

》ItisprobablegenerativeAIisdrivingglossier,

moreprofessional-

lookingphishingemails,whilelegitimateemailsareoftenmorestripped-downandutilitarian.

》Themorepolished

designshavenot

completelyreplacedthebasicones:analystsstill

seebothusedinphishingemails.EvenasgenerativeAIgainspopularityin

attackers’toolkits,the

threatlandscapeof2025remainsablendofolderphishingtemplatesandAI-enhancedphishing.

HumanRiskFindings14CyberThreatIntelligenceReport

IndustryObservations

Whilebulkphishingremainsbroadand

opportunistic,sometechniquesshowsigns

ofselectiveuse.Industry-specifictargetingis

limitedbutdoesoccur.Forexample,QR-code-basedluresstandoutinretailwheretheir

usageismorecommon,especiallyinconsumer-facingworkflows.Itisprobablethattacticsare

occasionallytailoredtosector-specificbehaviors,technologies,ortrustdynamics.

↑Figure9.

B

impersonationtargetinghotel

owners.

»Areviewofwestern

cybersecuritynewsinH1

2025reportedmore

human-riskrelatedattacksinthefinancialand

technology/ITindustriesthaninothersectors.

Evenifthebroaderdatadoesn’t

highlightstrongindustrytargeting,therearesomeclearexamplesof

campaignstargetedatspecificindustries.

Forexample,in2025several

campaignstargetingthe

hospitalityindustrywereidentified,impersonatingservicessuchas

B.Figure9shows

anexampleofsuchacampaign,requestingahoteltoconfirmitsdetailstoreactivateanaccount

While

B

impersonationsarenotanovelthreat,theyhave

persistedin2025asoneofthemostprominentexamplesofindustry

targeting.

»Acrossindustries,campaignsconsistently

relyoncoresocialengineeringtactics,such

asurgency,authorityimpersonation,and

moneytransferrequests.Thesetechniques

exploituniversalemotionalandhierarchical

triggers,makingthemeffectiveregardlessofthetargetsector.Threatdatareflectshigh-

volumecampaignsdesignedtobeuniversallyeffectivewithsomeexamplesofindustry-

specifictargeting.However,itisprobablethatmanyseeminglyindustry-focusedattacksareevenmoreprecise,aimingtobreachaspecificcompanyratherthanjustasector.

HumanRiskFindings16CyberThreatIntelligenceReport

RegionalAnalysis

Globallypopulartechniquesincludeurgency,money-transferlures,

authorityimpersonation,document-signinglures,andsecurityalerts.

However,threatdatasuggeststhatregionalvariationinphishingtacticsismorepronouncedthanindustry-specificdifferences.

ThissectionincludesexamplesofregionaltargetingforNorthAmerica,Asia-PacificandEurope.

»Areviewofwesterncybersecurity

newsinH12025reportedmorehigh-

profileattackstargetingprimarilyNorthAmericaandEasternEurope,withEastAsiaandWesternEuropefollowing.

Region:NorthAmerica

Basedonregionaldata,itisprobablethatvoicemail-themedphishing

ismorecommoninNorthAmerica

thaninEuropeorAsia-Pacific.With

wideradoptionofVoIPsystems,like

voicemail-to-emailsolutionsintoday’shybridworkingenvironments,fake

voicemailtranscriptsareanappealingtacticforthreatactors.Somethreat

actorsusingvoicemailtranscriptthemesfocusspecificallyonNorthAmerica.

Inthedataset,faxphishingalsoappearsmorecommonlyinNorthAmericathaninotherregions.

↑Figure10.Voicemail-themedMicrosoftimpersonationtargetingNorthAmerica.

↑Figure11.Exampleofafaxthemedphish.

HumanRiskFindings17CyberThreatIntelligenceReport

Fakesubscriptionrenewalthreatswhichoftenutilizecallbackphishing,were

observedmorefrequentlyinNorthAmerica.

Certainthreatactors,such

asLunaMoth1,havetargetedtheUnitedStateswith

callbackphishing.

CommonlyimpersonatedbrandsincludeMicrosoft,PayPal,GeekSquadandMcAfee.

→Figure12.Fakesubscriptioncampaignutilizingcall-backphishing.

Region:Asia-Pacific

InAsia-Pacific,‘businessopportunity’lures:

opportunitiestoogoodtobetrue,likelow-interestloansorinvestmentpitches,are

observedmorecommonlythaninEuropeorNorth

America.

←Figure13.Exampleofabusinessopportunitythemedphishing

campaign.

1:

/news/security/luna-moth-extortion-hackers-pose-as-it-help-desks-to-breach-us-firms/

HumanRiskFindings18CyberThreatIntelligenceReport

Region:Europe

InEurope,threat

actorsareexploitingconsumers’trustin

traditionalinstitutions:

basedonHoxhunt

data,itispossiblethat

financialinstitution

impersonationsreflecttargetedactivityin

Europe.

→Figure14.Exampleofa

financial-themedphishingemailimpersonatingHSBCBank.

»Althoughmanysocialengineeringtacticsaregloballypopular,

somegroupsspecializeregionallyandmayusesomewhatdifferenttacticsdependingonthetargetregion.Forexample,inEurope,

trustedfinancialinstitutionsaremorecommonlyimpersonated

thanelsewhere,whileinNorthAmerica,particularlytheU.S.,fakesubscriptionrenewalandvoicemail-relatedluresareobserved

morefrequently.

HumanRiskFindings19CyberThreatIntelligenceReport

TopTechniques

Attachmenttypes

In2025,PDFattachmentsremainthetopfiletypeusedinattachment-

basedphishing,accountingfor23.7%inthefirsthalfoftheyear(Figure16).

PDFattachmentsincludedfakeinvoiceswithfraudulentpaymentdetailsandfake

Europolletters,andsomecontainedlinksoradditionalattachmentsleadingtopayloads,oftencredentialharvesters.ItisprobablethatPDFs’abilitytobypassfiltersandappeartrustworthycontributedtotheirfairlystablesharefrom2024(Figure16).

HTMLattachmentsrankedsecondat5.6%inH1,downfrom10%in2024(Figure16).SVGattachmentsrankedthirdat5.0%,markingasignificantincreasefromnear-negligiblesharein2024(Figures15and16).MicrosoftWorddocuments,werefourthat4.4%,whileEMLattachmentsrankedfifthat1.4%inH12025(Figure16).

Other2025attachmentsrangedfromimagefiles(e.g.fakeinvoices)toexecutablefiles.However,becausephishingemailsreportedtoHoxhunthavealwaysalreadybypassed

filters,executablefileswhichareoftenblockedbysecurityfilters,donotmakeupasignificantproportionofthedataset.

AttachmentTypesbyPopularityin2025vs.2024

ure16.Top5

hmenttypesof2025aredtotheirshares4

In2025,SVGattachments

sawa50-foldincreasein

volumecomparedto2024

←Figattaccompin202

.pdf.html.svg.docx.eml

25%

15%

10%

5%

0%

Ontherise:SVGs

WhatareSVGs?

SVG(ScalableVectorGraphics)files

areXML-basedimageformatsused

fordisplayingvectorgraphicsonthe

web.Theycanincludescripts,links,andinteractiveelements.SVGfilescanbeusedinphishingtoembedmalicious

codeorredirectuserstofakeloginpages.

Whatarethemitigationmeasures?

Tomitigatetherisksassociatedwith

maliciousSVGfiles,it’sadvisableto

combinebothhuman-centricand

technicalsolutions.Usersshouldbe

trainedtoknowtherisksassociated

withSVG-filesthroughadaptivesecurityawarenesstraining,andsecurityoperatorsmightconsiderblockingorquarantiningemailswithSVGattachments.

Sincelate2024,theuseofSVGfilesinphishinghasseenalargeincreasefromanichebaseline.

In2025,attacksutilizingSVG

attachmentssaw50-fold

increaseinvolumecomparedto2024.SVGsappearasharmless

graphicfilesandbypassmanyanti-spamemailtools,makingthemanattractivetechniquetoattackers.

AsofSeptember2025,MicrosofthasstoppeddisplayinginlineSVGimagestomitigateincreasing

misuselikecross-sitescripting(XSS)attacks.SVGattachmentscontinuetobesupported2.

2024-07

2024-08

2024-09

2024-10

2024-11

2024-12

2025-01

2025-02

2025-03

2025-04

2025-05

2025-06

ShareofSVGfilesinAttachement-BasedPhishing(July2024–June2025)

16%

14%

12%

10%

8%

6%

4%

2%

0%

↑Figure15.PercentageofSVGsoutofallattachment-basedphishing(July2024–June2025)

2:

/news/security/microsoft-outlook-stops-displaying-inline-svg-images-used-in-attacks/

HumanRiskFindings21CyberThreatIntelligenceReport

QRCodes–NowinAttachments

InOctober2023,theoccurrenceofQRcodesinmaliciousemailrosefromnegligibletoover20%.InH12025,theyonlyshowedupinless

than2%ofmaliciousemails.

》Whatchanged:Detectionsimproved

andattackersreduceduseofQRcodes.

TheyarenowalsohidingQRcodesinsideattachmentslikePDFsorotherwise

obscuringthem,makingithardertotrackusage.

》Whatitmeans:Countsmayhavedeclinedbuttheriskpersists.WhenattackersdouseQRcodes,thegoalisthesameasbefore:

redirectinguserstomalicioussites.

》Bottomline:The2023spikereflected

filterbypass:asfilterscaughtup,

attackersadaptedbyhidingQRcodesinattachmentsorstartingtousedifferenttechniquesaltogether.

»QRcodesinphishingemailsmovedto

attachments,andtheoccurrancereduceddrastically.

HumanRiskFindings22CyberThreatIntelligenceReport

Senderdomains

InH12025,

accountedfor20%of

senderdomainsinmaliciousemails,compared

with2.8%for

,thesecondmost

popularorigindomain(Figure17).

»

accountedfor20%ofsender

domainsinmaliciousemails

Twofactorslikelycontributetothehigher

share:easeofaccountcreationandGmail’sroleasGoogle’ssolefreeconsumeroptionversus

Microsoft’smultipleoptions(Outlook,Hotmail,Live)andtheirregionalvariants.

Top5MaliciousSenderDomainsin2025(occurrence%)

0%5%10%15%20%25%

↑Figure17.Top5malicioussenderdomainsin2025.

HumanRiskFindings23CyberThreatIntelligenceReport

Phishingemailssentfrom3rdpartyservices

Threatactorsutilizethirdpartyservicesforsendingphishingemailstoincreaseperceivedlegitimacyandbypassemailfilters.Commontypesofmisuseincludesign-upsonSalesforceorDropbox(oruseofcompromisedaccounts)and

misuseofDocusignorPayPalmessagefields.

Sincelate2024,threatactorshaveincreasinglyusedSalesforce’smailing

services,oftenusing

noreply@.More

recently,campaignshaveevolvedtoleveragetheSalesforceMarketingCloud,expandingdelivery

methodsbeyondtraditionaltransactionalsenders.

Salesforce’sshareofsenderdomainsamongmaliciousemailsrosefrom0.6%inJanuaryto1.8%inJune(Figure18).Salesforcehasbeencommonlymisusedforthedeliveryofrecruitment-themedcampaigns,seeMetaCampaign

Comparisonssectionforacampaignexample.

Shareofphishingemailssentfrom

01/2024

–

06

/2025

2.0%

1.5%

1.0%

0.5%

0.0%

2024-02

2024-03

2024-04

2024-05

2024-06

2024-07

2024-08

2024-09

2025-02

2025-04

2025-06

2024-01

2024-10

2024-11

2024-12

2025-01

2025-03

2025-05

↑Figure18.Shareofphishing

emailssentfrom

(January2024–June2025)

»Sincelate2024,threatactorshaveincreasinglyusedSalesforce’smailingservices,oftenusing

noreply@

.

Phishinglinks

600%

increaseinsocialmediain

phishingemailssince2023.