Most polymorphic phishing emails are sent from compromised accounts (52%), followed by phishing domains (25%), and webmail (20%).

76.4% of all phishing campaigns now use polymorphic phishing tactics.