In 2025, 'polymorphic' attacks that varied the email header, body, and destination were seen in 20% of phishing attacks.

Most polymorphic phishing emails are sent from compromised accounts (52%), followed by phishing domains (25%), and webmail (20%).

76.4% of all phishing campaigns now use polymorphic phishing tactics.