100% of advanced email threats bypassed incumbent email security, including Microsoft E3/E5 and leading secure email gateways.

87 out of every 10,000 users clicked on a phishing link each month in 2025.

In 2025, 90% of high-volume phishing campaigns utilized Phishing-as-a-Service (PhaaS) kits.

DocuSign accounted for more than 20% of all advanced email attacks analyzed.

In late 2025, there were 10 million Mamba 2FA phishing attacks recorded.

In 2025, malicious attachments were present in 18% of phishing attacks.

In 2025, the abuse of trusted, legitimate online platforms was noted in 10% of phishing attacks.

In 2025, the use of 'Blob URIs' was noted in 2% of phishing attacks.

In 2025, attacks leveraging generative AI were reported in 10% of phishing attacks.

In 2025, CAPTCHA was leveraged for added authenticity in 43% of phishing attacks.

In 2025, 'polymorphic' attacks that varied the email header, body, and destination were seen in 20% of phishing attacks.

89% of schools experienced at least one cyber incident in the past year, primarily phishing, unauthorized access, and malware.

92% of school IT leaders expect AI-powered phishing to be the most dangerous threat in the coming year

IT leaders estimate only 5% of known phishing attacks are reported by healthcare employees to their security teams.

68% of all phishing infrastructure tracked operates on Cloudflare as of the current year.

Almost 60% of the observed indicators of compromise (IOCs) are linked with Phishing-as-a-Service (PhaaS).

The mean DNS resolution rate for phishing operators was 96.16%, indicating high availability and minimal downtime.

51.54% of the phishing infrastructure is directly hosted, while 48.46% is protected by CDN/proxy services.

Over the past four months, 20 distinct phishing clusters were identified based on shared infrastructure fingerprints.

In the last quarter, over 42,000 validated URLs and domains were identified as actively serving phishing kits, command-and-control infrastructure, or payload delivery.