Cyberstats

Security Intelligence

VIPRE

Cybersecurity reports and statistics published by VIPRE

8 categories1 reports

Research Reports

Reports and publications from VIPRE

Email Threat Trends Report: Q2 2025

Recent Statistics & Reports

58% of phishing sites now use unidentifiable phishing kits.

Email Phishing Phishing kit

Among the unidentifiable phishing kits used by phishing sites, 16shop accounts for 7%.

Email Phishing Phishing kit

Among the unidentifiable phishing kits used by phishing sites, Evilginx accounts for 20%.

Email Phishing Phishing kit

Among the unidentifiable phishing kits used by phishing sites, Tycoon 2FA accounts for 10%.

Email Phishing Phishing kit

The use of URL shorteners accounts for 7% of phishing delivery.

Email Phishing Phishing delivery

PDFs remain the preferred vehicle for delivering malicious attachments in phishing, at 64%.

Email Phishing Phishing delivery

The most observed phishing exploitation mechanisms are HTTP POST to remote server accounting (52%) and email exfiltration (30%).

Lumma Stealer is the most encountered malware family found in the wild during Q2 and is often delivered via malicious .docx, .html, or .pdf attachments, or through phishing links hosted on compromised or legitimate-looking cloud services such as OneDrive, and Google Drive.

Email Phishing Lumma Stealer

Swedish and Norwegian targets comprise a combined 19% of BEC targets.

Email Phishing BEC

For Business Email Compromise (BEC) attacks, English-speaking executives remain the most targeted at 42%.

Email Phishing BEC

A significant portion of BEC targets are Danish, at 38%.

Email Phishing BEC

Retail was the second most targeted sector for email-based attacks in Q2 2025, accounting for 20% of attacks.

Email Phishing Retail

Swedish language use in BEC scams is 3.8%.

Email Phishing BEC

Norwegian language use in BEC scams is 1.5%.

Email Phishing BEC

After CEOs and executives, the remaining BEC impersonation efforts are aimed at directors and managers (9%), HR personnel (4%), IT staff (3%), and school heads (2%).

Email Phishing BEC

Financial lures are the number one ploy in phishing emails, representing 35% of samples.

Email Phishing Phishing lure

Account verification and updates account for 20% of approaches in phishing emails.

Email Phishing Phishing lure

Compromised websites are the second most prevalent link delivery method, at 30%.

Email Phishing Phishing delivery

Among the unidentifiable phishing kits used by phishing sites, other generic kits account for 5%.

Email Phishing Phishing kit

Package delivery messages account for 5% in phishing emails.

Email Phishing Phishing lure

Showing first 20 results

Top Categories

8

8

5

Phishing delivery

4

2

Related Vendors