82.6% of all phishing emails analysed exhibited some use of AI.

In 2024, there was a 47% increase in phishing emails evading detection by Microsoft’s native security and secure email gateways.

New starters typically received a phishing email after 3 weeks.

On average, phishing emails contained 1058 characters (~188 words)

76.4% of all phishing campaigns now use polymorphic phishing tactics.

Ransomware payloads in phishing attacks have risen by 22.6% over six months, with a sharp 57.5% increase in just three months.

The top three words used in phishing emails: Urgent, Review, Sign.

There has been a 57.9% increase in phishing attacks being sent from compromised accounts getting through traditional detection.

Job application-related phishing attacks are not only sent to individual accounts (24%) but also shared mailboxes (52%) and individual inboxes with activated delegate functions (21%) (e.g. a personal assistant has access to an executive’s inbox).

Between September 15, 2024 and February 14, 2025, there was a 11.1% incease in phishing emails sent from compromised email addresses within the supply chain.

Between September 15, 2024 and February 14, 2025, there was a 67.4% incease in the use of third-party platforms for phishing emails.

64% of phishing attacks are focused on engineering roles.

There is up to six days as the average window of exposure before legacy security tools begin blocking pages from zero-hour phishing attacks.

Nearly 51% of browser-based phishing attempts involved some form of brand impersonation in 2024.

Cybercriminals created nearly 1 million new phishing sites each month in 2024. This represents a 700% increase since 2020.

75% of phishing links are hosted on good, trusted websites.

Four of the top five hosting providers used by bad actors to host phishing attacks were based in the U.S. in 2024.

Phishing attacks hosted on subdomain providers increased by 51% in 2024, representing 24% of all phishing attacks.

There has been a 140% increase in browser-based phishing attacks in 2024 compared to 2023.

Cybercriminals created nearly 1 million new phishing sites each month in 2024. This represents a 700% increase since 2020.