In 2025, obfuscations to hide URLs from detection were seen in 48% of phishing attacks.

In 2025, attacks bypassing multifactor authentication (MFA) were reported in 48% of phishing attacks.

In 2025, malicious QR codes were observed in 19% of phishing attacks.

In 2025, malicious attachments were present in 18% of phishing attacks.

In 2025, the use of 'Blob URIs' was noted in 2% of phishing attacks.

In 2025, 'ClickFix' social engineering techniques were used in 1% of phishing attacks.

In 2025, 'polymorphic' attacks that varied the email header, body, and destination were seen in 20% of phishing attacks.

In 2025, CAPTCHA was leveraged for added authenticity in 43% of phishing attacks.

In 2025, the abuse of trusted, legitimate online platforms was noted in 10% of phishing attacks.