Key findings
1 in 3
email messages are malicious or unwanted spam.
34%
of companies experience at least one account takeover incident every month.
48%
of malicious email activity is phishing.
>10%
of all HTML attachments are malicious.
70%
of malicious PDFs contain QR codes leading to phishing websites.
90%
of high-volume phishing campaigns used phishing-as-a-service kits.
Executive summary
AI-driven social engineering and phishing-as-a-service (PhaaS) are increasing both the volume and effectiveness of email-based attacks. In January 2026, Barracuda Research, the threat intelligence arm of Barracuda, analyzed more than 3.1 billion emails, looking at malicious, spam or unwanted emails and identifying trends showing that attackers are scaling credential phishing, shifting from file-based payloads to URL-based delivery, and using QR codes and account takeover (ATO) to bypass conventional controls. This report summarizes the most common attack types, the highest-risk attachment and link behaviors, and practical steps to reduce risk across email, identity and endpoints.
Who this report is for
This report is written for CISOs, security leaders, SecOps teams, IT administrators and managed service providers (MSPs) who need a clear view of current email threats (phishing, business email compromise (BEC), impersonation, malicious attachments, and account takeover) and the controls that reduce risk.
Methodology
This report is based on proprietary Barracuda data gathered during January 2026. During this period, Barracuda Research, the threat intelligence arm of Barracuda, analyzed more than 3.1 billion emails, looking at malicious, spam or unwanted emails. The findings presented here reflect the key trends and threat patterns identified across that dataset.
- AI-driven threats and phishing-as-a-service
- The most common types of email attacks
- Malicious attachments drive malware distribution
- Attackers are shifting from files to links
- QR codes hide links in attachments
- Account takeover opens the door to phishing
- The evolution and dominance of phishing-as-a-service
- How to strengthen email security and cyber resilience
AI-driven threats and phishing-as-a-service (PhaaS)
Key takeaways
- PhaaS is industrializing credential phishing, increasing volume and reducing attacker skill requirements.
- Adversary-in-the-middle-style kits raise risk even in MFA environments by intercepting sessions in real time.
- Higher email attack volume increases alert fatigue and the likelihood of missed detections, especially for small and mid-size businesses.
- Email security must be paired with identity and endpoint controls to reduce account takeover and lateral movement.
What is phishing-as-a-service (PhaaS)?
PhaaS is a criminal subscription model that provides phishing templates, fake login pages, hosting and automation that make credential phishing easier to launch and scale. Many modern kits also use adversary-in-the-middle (AiTM) techniques to intercept sessions and bypass multifactor authentication (MFA).
The new frontline of email attacks
Email continues to be a prominent attack vector providing cybercriminals with a direct and trusted gateway into corporate networks. This risk is amplified by the growing sophistication and accessibility of artificial intelligence (AI) and phishing-as-a-service (PhaaS) platforms. These two factors are fundamentally changing the threat landscape, making it easier for attackers to escalate their operations, increasing both the volume and complexity of their attacks.
Notably, one in three email messages today is either malicious or unwanted spam — up from one in four last year. This increased volume of attacks creates a variety of challenges for IT teams, especially those with limited resources.
Malicious vs. legitimate email
33%
67%
Malicious or unwanted email messages
Legitimate email messages
These attacks are increasingly fueled by PhaaS — a criminal business model that makes sophisticated phishing campaigns easy to launch and scale. PhaaS platforms provide ready‑made phishing templates, fake login pages, hosting infrastructure, and automation tools — often available through low‑cost subscription plans. This enables even inexperienced attackers to target thousands of victims at once. By industrializing phishing, PhaaS is driving higher attack volumes, faster campaign launches and more consistent success rates for email‑based threats. Some modern PhaaS platforms operate as sophisticated man-in-the-middle proxies, enabling attackers to intercept and spoof multifactor authentication processes with advanced tools.
As cybercriminals continue to evolve their tactics to evade traditional defenses, businesses must proactively reduce risk by implementing a comprehensive, multi-layered email security strategy. This includes leveraging AI-enhanced threat detection, real-time monitoring and ongoing user awareness training to strengthen resilience against sophisticated attacks.
Higher impact on smaller businesses
The relentless volume of malicious email not only increases the odds of a successful attack but also contributes to alert fatigue and operational strain. Because they tend to have smaller teams, less mature security infrastructure and limited cybersecurity budgets, small and medium-size businesses are particularly vulnerable to email-based threats. They often rely on basic or native email security solutions that will struggle to stop more sophisticated attacks like business email compromise , phishing and ransomware. When malicious messages blend into legitimate traffic, even a small detection gap can lead to account takeover, lateral movement or costly downtime.
The consequences of a single successful attack can be significant: direct financial loss, reputational damage and in some cases, the potential for business closure. As regulatory requirements become more stringent, even minor data breaches can expose companies to fines, legal action and long-term operational risk.
The most common types of email attacks
Key takeaways
- Phishing is the dominant malicious email category (48%), making credential theft prevention a primary control objective.
- Low-volume threats like BEC can be disproportionately costly; prioritize anti-impersonation controls and payment-process safeguards.
- Unauthenticated email (missing SPF/DKIM/DMARC alignment) increases spoofing and impersonation risk.
1.6%
Bulk email
Bulk email clutters inboxes, making it harder for users to identify important messages and increasing the risk of missing critical communications.
16%
Spam
Spam floods email systems with unwanted content, reducing productivity and driving up operational costs for businesses.
3.8%
Spoofing and impersonation
Spoofing and impersonation attacks forge sender identities or domains to appear legitimate, tricking recipients into sharing sensitive information.
48%
Phishing
Phishing drives the largest share of malicious email activity, reinforcing the fact that broad, high-volume credential-theft campaigns remain the most reliable entry point for attackers.
6.9%
Unauthenticated mail
Unauthenticated mail lacks verification through protocols like SPF, DKIM or DMARC, making these messages more susceptible to spoofing, phishing and fraud.
0.10%
Conversation hijacking
Conversation hijacking occurs when attackers compromise an email account and insert themselves into active email threads to manipulate discussions.
0.9%
Extortion
Extortion emails threaten recipients with harm — such as exposing sensitive data or launching a cyberattack — unless a ransom is paid.
0.45%
Spear phishing
Spear phishing uses tailored, highly targeted messages to impersonate trusted individuals or organizations, increasing the likelihood of bypassing defenses.
1.8%
Malicious attachments
Malicious attachments deliver harmful code such as ransomware, spyware or other malware, leading to data loss, financial damage or system compromise.
0.06%
Business email compromise
Business email compromise attacks are low in volume but extremely high in impact, using executive or partner impersonation to deceive employees into transferring funds or sensitive information.
21%
Other
This includes a wide range of blocked or quarantined messages — such as emails sent to invalid recipients or those flagged by custom security policies. This segment underscores the ongoing operational burden of managing non-deliverable, anomalous and policy-violating email traffic.
Malicious attachments drive malware distribution
Key takeaways
- Malicious attachments, especially HTML files, remain a major driver of malware distribution and pose significant risks by evading traditional security controls.
- Attackers increasingly exploit user trust in common file formats and adapt their tactics to bypass defenses, highlighting the need for deep inspection and behavioral analysis of attachments.
- To effectively prevent compromise, organizations must go beyond simple file-type checks and actively monitor for malicious behaviors across all attachment types.
Email attachments remain an important tool for cybercriminals, and attackers are constantly adapting the file types they use, exploiting user trust, familiarity with common formats and weaknesses in inspection tools to bypass defenses.
To effectively prevent initial compromise and limit the impact of malicious content, security teams must go beyond simple file-type checks and instead inspect and correlate file behavior across a wide range of attachments. This proactive approach is essential for catching threats that traditional controls may miss and reducing the potential blast radius when malicious files reach users.
Percentage of different attachment types that are malicious
HTML
10.48%
Scripts
1.14%
0.15%
Microsoft 365 documents
0.15%
Archive
0.31%
Figure 2: HTML attachments are disproportionately weaponized compared to other common formats; PDFs are common but are increasingly used to carry QR codes and links.
HTML files are the most weaponized
Despite a relatively low overall volume, HTML attachments are the most weaponized file type, accounting for about two-thirds of all malicious files detected in emails. With about 11% marked as malicious, they represent one of the riskiest attachment types.
Attackers favor HTML attachments because they can embed deceptive forms and scripts that mimic legitimate content, often slipping past traditional filters. When opened, HTML attachments render locally in the user’s browser and execute embedded HTML or JavaScript that can redirect victims to credential-harvesting sites, dynamically load malicious content or evade URL rewriting and reputation checks. To counter these threats, security teams should enforce strict policies for handling HTML attachments, including thorough scanning for embedded scripts and blocking suspicious files.
Microsoft 365 documents remain highly exploitable
Microsoft 365 documents are widely used in legitimate business communications, which makes them a popular choice for cybercriminals that want to compromise business accounts. While they have a relatively low observed malicious rate of 0.15%, they post a significant risk because users inherently trust them and they are deeply integrated into business workflows and cloud identities. Attackers continue to capitalize on this trust by exploiting Microsoft 365 documents to deliver malware, often through macros or embedded links.
PDFs are used less frequently for malicious purposes
PDFs are the most frequently shared type of email attachment, but they carry a relatively low risk, with only 0.15% of PDFs identified as malicious. However, PDFs are being increasingly weaponized in phishing campaigns, with attackers embedding malicious links, QR codes or deceptive branding designed to direct recipients to credential-harvesting sites. Because PDFs are widely trusted and rarely blocked outright, cybercriminals use them to bypass user suspicion and perimeter filtering, especially in impersonation and invoice-based fraud campaigns.
Archive files and scripts enable evasion
Archive files, such as ZIP and RAR, have a relatively low malicious rate of 0.13%, but attackers use them to spread malware and evade detection. Similarly, scripts — including JavaScript and PowerShell — are uncommon as malicious attachments, with only about 1% marked as harmful. However, the risk remains significant because scripts can execute dangerous payloads, particularly when embedded in other types of files. Archives can bypass attachment inspection when nested or password-protected, forcing reliance on user interaction for detection.
Attackers are shifting from files to links
Key takeaways
- URLs are becoming the primary delivery method as attachment sandboxing and file-type controls improve — attackers are adapting by moving payloads onto the web.
- Even at ~0.56% (about 1 in 200), malicious links are encountered often at enterprise scale — and one click can trigger credential theft, malware, or ransomware.
- Newly registered domains, redirect chains, and fast-changing hosting make many attacks look clean at delivery time and beat signature/reputation-only controls.
- Successful link-based phishing leads to account takeover, which then fuels downstream fraud, lateral movement, and internal phishing from trusted accounts.
As email security solutions advance detection capabilities by deploying technologies such as attachment sandboxing, cybercriminals are adapting their tactics to evade detection. Barracuda Research has identified a marked increase in URL-based attacks over direct file attachments, as attackers seek new ways to bypass enhanced defenses.
This shift provides several strategic advantages for cybercriminals:
Abuse of legitimate services
Cybercriminals can host malicious content on reputable platforms, such as SharePoint, OneDrive, Google Drive, GitHub and Bitbucket, allowing them to circumvent reputation-based filters and exploit users’ trust in these services.
Time-bound evasion
Attackers can program links to expire or change behavior after a specific period, making post-delivery forensic analysis extremely challenging for security teams.
Dynamic payload delivery:
Threat actors can keep a link ‘benign’ during initial scans and then later replace it with a malicious payload such as a credential harvester or malware, ensuring the attack is only activated once the email has reached the recipient’s inbox.
Since the start of 2026, Barracuda Research analysts have witnessed a notable surge in these URL-driven tactics compared to previous years. They expect this trend to continue, as attackers increasingly use URLs as their primary vehicle to compromise accounts and steal credentials — often slipping past traditional scanning tools and making detection and tracking far more difficult.
Malicious links pack a punch despite low volume
Even though only about one in every 200 links is malicious, the threat remains persistent and serious. Cybercriminals use these links for phishing, impersonation and malware campaigns — often making them look legitimate enough to slip past traditional security filters.
Why it matters
Even a small percentage of malicious URLs can have a major impact because a single successful click can lead to credential theft, account takeover and follow-on fraud. Attackers that obtain valid logins can gain long-term, often undetected access to business environments, giving them the ability to move laterally, escalate attacks and compromise sensitive data. URL-based delivery also enables time-of-click evasion and abuse of trusted hosting platforms.
How malicious links are used — and the damage they cause
Phishing and credential theft
Malicious links are a central part of phishing schemes designed to steal login credentials. When users click these links, they’re directed to convincing fake login pages that closely resemble trusted services like Microsoft 365. These sites harvest usernames and passwords, giving attackers unauthorized access to business accounts. The consequences extend far beyond simple credential theft: Cybercriminals can compromise identities, expose sensitive data and seize control over email and cloud environments.
Malware and ransomware delivery
Malicious links frequently lead users to sites that deliver malware-laden files, often cleverly disguised as routine business documents like payment invoices, software updates or urgent security notifications. These downloads are intentionally crafted to look legitimate, which increases the chance that recipients will trust the content and inadvertently install harmful software.
Bypassing traditional detection controls
Attackers are increasingly using newly registered domains, complex redirect chains and dynamic hosting infrastructure to disguise malicious links, making them appear benign when they’re delivered. As a result, many embedded links are zero-day or previously unknown, which significantly limits the effectiveness of signature-based and reputation-driven defenses.
Cross channel and mobile exploitation
Malicious links often push users to open content on mobile devices or in external browsers — environments where organizational security controls may be weaker or completely absent. This expands the attack surface beyond email and into identity, endpoint and mobile security gaps, which makes effective containment and remediation much more challenging for security teams.
Even with just over half a percent of links (0.56%) being malicious, the sheer volume of email traffic means employees are likely to encounter them. Security teams need protection that evaluates links in real time — analyzing destination behavior, redirects and impersonated login flows rather than relying solely on static reputation at delivery.
QR codes hide links in attachments
Key takeaways
- QR codes are “links in disguise.” They hide the destination from both users and many email/link inspection controls, letting phishing URLs slip through as an image inside a document.
- Scanning typically happens on a phone, moving the interaction outside the corporate endpoint and often outside core monitoring and protection.
- In this dataset, 70% of malicious PDFs and 56% of malicious Microsoft 365 documents contained QR codes—making QR detection a practical priority, not an edge case.
What is QR code phishing?
QR code phishing (sometimes called quishing) is a phishing technique where attackers embed a QR code in an email or attachment (often a PDF) that, when scanned, sends the victim to a malicious website — typically a fake login page — designed to steal credentials or deliver malware.
Cybercriminals are increasingly embedding malicious QR codes in email attachments to trick users and bypass traditional security controls. These attacks are particularly challenging because QR codes appear as innocuous images, allowing them to slip past many security filters undetected. QR code-based attacks also reveal critical gaps between email security, endpoint protection and identity controls — blind spots that allow attacks to evade detection.
Malicious QR codes often appear in trusted file formats, especially PDFs and Microsoft 365 documents. In fact, 70% of malicious PDFs and 56% of malicious Microsoft 365 documents analyzed contain QR codes that redirect users to phishing sites or other harmful destinations. These file types are widely used in business workflows, making them ideal vehicles for social engineering. When users scan these QR codes, they are often taken to fake Microsoft 365 login pages designed to harvest credentials and compromise business accounts. This growing threat underscores the urgent need for advanced security solutions capable of inspecting and analyzing QR codes embedded in attachments — helping security teams address blind spots and reduce the risk of account takeover and data breaches.
Why attackers turn to QR codes
Bypassing traditional email defenses
QR codes can conceal shortened URLs, complex redirect chains or dynamically generated destinations, making it difficult for security systems to evaluate intent at the time of delivery. Because encoded content remains hidden until scanned, attackers can modify payloads after the email is delivered, effectively circumventing time-of-click protections.
Shifting attacks to mobile devices
QR codes are typically scanned using mobile devices, which moves the attack off the corporate endpoint and outside the organization’s primary security perimeter. This tactic is especially concerning because mobile devices frequently lack the advanced endpoint protection, browser isolation and conditional access controls found on managed corporate systems. As a result, attackers can exploit these weaker defenses to increase their chances of success and evade traditional detection mechanisms.
Exploiting user trust and familiarity
QR codes have become a staple of everyday business workflows and are now used regularly for multifactor authentication (MFA) enrollment, document signing, payroll updates, and identity verification, making them effective lures in impersonation and phishing campaigns. This widespread adoption can reduce suspicion and increase the likelihood that users will scan a malicious code, making QR codes highly effective tools for impersonation and phishing attacks.
Account takeover opens the door to phishing
Key takeaways
- Account takeover is a force-multiplier: compromised accounts make phishing more believable because messages come from trusted senders.
- Mailbox rule changes (forwarding/deletion) are high-signal indicators and should trigger immediate investigation.
- Combine user training with identity telemetry (risky sign-ins, impossible travel) and automated response to contain incidents quickly.
What is account takeover (ATO)?
Account takeover occurs when an attacker gains unauthorized access to a user’s email or cloud identity (often through phishing or credential stuffing) and then uses that access to steal data, manipulate inbox rules, impersonate employees, or launch follow-on phishing and business email compromise (BEC).
Account takeover is now a widespread security concern for businesses, with 34% of companies experiencing at least one account takeover incident each month. This reinforces the fact that identity compromise is no longer an edge case. It’s a routine security risk for modern organizations and can have potentially severe consequences.
Attackers typically gain access using phishing tactics, credential stuffing or by exploiting weak passwords. Once attackers are inside, they can steal sensitive information, move laterally throughout the organization and launch phishing campaigns from compromised accounts that appear legitimate to unsuspecting recipients.
Warning signs of account takeover
Typical indicators of account takeover include unusual login activity from unfamiliar locations or devices, unauthorized changes to inbox or email forwarding rules, unexpected password reset requests, and the presence of outbound phishing emails originating from compromised accounts. These warning signs often signal that an attacker has gained access and is actively manipulating the account for malicious purposes.
Account takeover attacks pose long‑term, ongoing security risks by enabling attackers to conduct stealthy reconnaissance and launch follow‑on attacks. Notably, 25% of account takeover incidents involved suspicious changes to inbox rules, such as forwarding emails to external accounts or automatically deleting security notifications, which enable attackers to remain hidden and sustain access. In addition, 14% of compromised accounts were used to distribute spam and other harmful content, often fueling further phishing attacks, malware infections and business email compromise schemes.
These tactics illustrate how account takeover incidents can escalate quickly, exposing organizations to broader risks and complicating detection and response efforts. Robust account protection starts with detecting early warning signs of compromise, such as unusual login behavior, mailbox manipulation and abuse of legitimate access.
To effectively counter these threats, organizations must enable real-time detection and response capabilities that can stop attackers before they can establish persistence or escalate to financial fraud and broader breaches.
The evolution and dominance of phishing-as-a-service
Key takeaways
- Subscription PhaaS kits provide templates, hosting, automation, and analytics, so attackers can launch credible campaigns without deep technical skill.
- In this dataset, 90% of high-volume phishing campaigns used PhaaS kits, indicating that most large campaigns are now kit-driven.
- Many kits include AiTM capabilities that can steal session tokens and bypass MFA, raising the impact of a single successful lure.
In 2025, Barracuda threat analysts observed a dramatic shift in the phishing landscape: 90% of high-volume phishing campaigns used PhaaS kits — a steep increase from just 30% in 2024. This spike highlights how PhaaS has radically lowered the barrier to entry, empowering even inexperienced cybercriminals to launch large-scale, highly targeted attacks with advanced automation, impersonating well-known brands and trusted services. The result is a threat environment where highly convincing and sophisticated attacks are now commonplace, not the exception.
PhaaS has transformed phishing into a high-volume, fast-moving operation, accelerating the launch of campaigns and increasing their chances of success. Today’s most sophisticated PhaaS platforms operate as advanced man-in-the-middle proxies, offering attackers tools to intercept and manipulate multifactor authentication — including real-time MFA interception and spoofing — making credential theft and account compromise easier than ever before.
Main themes of PhaaS attacks
The most prevalent PhaaS attack themes in 2025 included fake payment requests, financial notifications, legal correspondence, digital signature prompts, and HR-related messages. Each of these campaigns were designed to trick recipients into clicking malicious links, scanning QR codes or opening attachments, ultimately leading them to share sensitive information. Attackers frequently impersonated well-known brands like Microsoft, DocuSign and SharePoint, and they succeeded by harnessing generative AI, sophisticated evasion techniques and a wider array of legitimate platforms to host and distribute content, making attacks even more convincing and difficult to detect.
Top attack email themes used by phishing kits in 2025
Financial and legal document scams
10%
HR-related scams (benefits, payroll, etc)
13%
Voicemail scams
15%
Signature and document review scams
18%
Payment & invoice scams
19%
Other
25%
Figure 3. Attackers are aligning lures to routine business processes (payments, HR, and signatures) to maximize credibility and clicks.
Common methods used by phishing kits
Popular techniques that Barracuda’s threat analysts observed in phishing kits in 2025 included obfuscation to hide URLs from inspection (48%), attacks bypassing MFA (48%), CAPTCHA for added authenticity (43%), polymorphic attacks varying email headers and bodies to help avoid detection (20%), malicious QR codes (19%), malicious attachments (18%), abuse of trusted online platforms (10%), attacks using generative AI (10%), Blob URIs for stealth (2%), and ‘ClickFix’ social engineering (1%).
Top techniques used by phishing kit attacks in 2025
MFA bypass
48%
URL obfuscation
48%
CAPTCHA abuse
43%
Polymorphic attacks
20%
Malicious QR codes
19%
Malicious attachments
18%
Attacks leverating generative AI
10%
Abuse of trusted platforms
10%
Blob UIRs
2%
Clickfix
1%
Figure 4. Modern PhaaS kits combine evasion, MFA bypass and multi-channel delivery (links, QR, attachments) to reduce detection and increase conversion.
The rapid growth of phishing kits
The number of PhaaS kits in active use doubled in 2025, with established platforms like Tycoon 2FA and Mamba 2FA facing competition from newcomers such as Cephas, Whisper 2FA, GhostFrame, Sneaky 2FA, and CoGUI. These advanced kits share an emphasis on sophisticated anti-analysis capabilities, MFA bypass techniques and stealth deployment strategies. For example, Sneaky 2FA uses adversary-in-the-middle tactics paired with Microsoft API integration, while GhostFrame employs dynamic subdomains and iframe abuse to evade detection. This rapid innovation continually shifts the defensive landscape, making defense and detection a moving target for security teams.
At the end of 2025, Barracuda threat analysts observed a surge in activity from established kits, including nearly 10 million attacks from Mamba 2FA alone. The current PhaaS threat landscape is increasingly crowded, diverse and rapidly shifting, as both emerging and legacy kits continue to evolve, presenting a growing challenge for defenders.
How to defend against PhaaS attacks
To effectively counter these evolving threats, organizations need to go beyond basic detection and embrace AI-enhanced, integrated security platforms that deliver real-time monitoring and adaptive defenses to respond to new attack tactics as they emerge. Building a resilient security culture — through continuous user education, robust authentication practices and regular software updates — is essential for protecting against the sophisticated tactics used in PhaaS-driven attacks.
How to strengthen email security and cyber resilience
As cybercriminals continue to adapt their tactics, email based threats will keep growing in scale, volume and sophistication. The most effective defense combines robust, multi-layered email security with a strong focus on cyber resilience. Together, protection and resilience empower businesses to minimize risk, swiftly detect threats that slip past defenses, and recover quickly when incidents occur.
Implement layered, AI-enhanced email security
Email gateways and spam filters remain a critical first line of defense, but they’re not always configured to block today’s more evasive attacks. Advanced, intelligent email solutions should play a central role, helping detect targeted phishing attacks and other sophisticated threats that don’t rely solely on malicious links or attachments. To maximize effectiveness, IT teams should also regularly review and tune email security settings to ensure optimal performance. Robust, multi-layered threat protection is essential, as cybercriminals continue to refine their tactics to bypass traditional safeguards.
Protect access and accounts
Securing user access and email accounts should be a core part of every cybersecurity strategy. Implementing MFA adds an important layer of protection beyond usernames and passwords, significantly increasing account protection. To further strengthen security, businesses should also consider adopting a zero-trust approach that continuously verifies users and limits access to only what’s required. By prioritizing access controls, organizations can reduce the risk of account takeover and prevent attackers from moving laterally within their networks.
Automate incident response
Leverage automation to accelerate your organization’s ability to detect, investigate and remediate email threats. Automated incident response tools can swiftly analyze suspicious messages, remove malicious emails and launch predefined workflows — reducing dwell time and limiting the spread of email-based attacks.
Help users recognize and report threats
Equipping users with the knowledge and tools to spot suspicious emails is a critical layer of defense. Regular training helps employees recognize the latest phishing tactics, understand how attacks work and know how to report suspicious messages. Phishing simulations — including across email and voicemail — can reinforce learning, test readiness and help identify areas where additional training is needed.
Secure and back up critical data
Email-based attacks can lead to data loss through ransomware, fraud and unauthorized access. Implement comprehensive backup strategies that include frequent, automated backups of email, files and other business-critical information. Ensure backups are encrypted, stored in secure locations and regularly tested for reliability and rapid recovery.
Reduce risk from misconfigurations and policy gaps
Even the most advanced email security solutions can be undermined by misconfigurations, outdated policies or unused security controls. As environments grow more complex, unchecked configurations become increasingly common. Misaligned policies, overly permissive rules and forgotten exceptions can create blind spots that attackers actively exploit to bypass defenses.
Organizations should regularly audit email security configurations to ensure protections are enabled, policies are aligned with current threat trends and exceptions are still justified. This includes reviewing authentication settings, attachment and link inspection policies, impersonation protections, and automated response workflows. Continuous monitoring and configuration hygiene help close gaps that attackers rely on and ultimately help reduce false negatives, limit exposure and ensure email security controls perform as intended over time.
Stats and implications
Use the table below to map the report’s top statistics to practical security implications and the controls that reduce risk.
| Metric | Value | What it means | Defensive action |
|---|---|---|---|
|
Email messages that are malicious or unwanted spam
|
1 in 3
|
High baseline volume increases user exposure and alert fatigue, raising the odds of a successful click or credential submission.
|
Tune email controls to reduce noise; use layered detection (impersonation + link + attachment) and streamline user reporting.
|
|
Share of malicious email activity that is phishing
|
48%
|
Credential phishing remains the primary entry path, and successful phishing often leads to identity compromise and follow-on fraud.
|
Harden identity (MFA/conditional access), deploy phishing-resistant MFA where possible and add time-of-click URL protection.
|
|
Companies experiencing at least one account takeover (ATO) incident monthly
|
34%
|
ATO is routine, not rare; compromised accounts increase trust in downstream phishing and BEC attempts.
|
Monitor risky sign-ins and inbox rule changes; automate containment (password reset, token revocation, session termination).
|
|
HTML attachments identified as malicious
|
>10%
|
HTML attachments are disproportionately weaponized and can redirect users to credential-harvesting pages or load malicious content dynamically.
|
Apply stricter policies for HTML attachments (block, quarantine or detonate); scan for scripts and embedded redirects.
|
|
Malicious PDFs that contain QR codes
|
70%
|
QR codes can conceal destination URLs and shift the attack to mobile/external browsers where controls may be weaker.
|
Inspect attachments for QR codes; train users on QR risk; enforce mobile conditional access and safe browsing protections.
|
|
Links identified as malicious
|
0.56%
|
Even low percentages can translate into frequent encounters at scale; a single click can lead to credential theft and ATO.
|
Use real-time link analysis (redirect chains, detonation); block newly registered domains where feasible; add browser isolation for risky clicks.
|
|
ATO incidents involving suspicious inbox rule changes
|
25%
|
Inbox rules (forwarding/deletion) are a strong signal of persistence and can hide attacker activity.
|
Alert on auto-forwarding/external rules; restrict forwarding; require admin approval for rule changes in high-risk accounts.
|
|
Compromised accounts used to distribute spam or harmful content
|
14%
|
Attackers monetize access quickly and use internal trust to expand reach and improve deliverability.
|
Enable outbound anomaly detection; throttle suspicious sending; implement DMARC and internal sender tagging to reduce impersonation impact.
|
|
High-volume phishing campaigns using PhaaS kits
|
90%
|
Phishing is being industrialized; campaigns are faster to launch, more consistent, and often incorporate MFA bypass techniques.
|
Add layered anti-phishing (brand/impersonation detection), strengthen identity security and rehearse incident response for credential theft and ATO.
|
Frequently asked questions
In this dataset, phishing represents the largest share of malicious email activity (48%). Other common categories include spoofing/impersonation, unauthenticated mail that increases spoofing risk, and lower-volume but high-impact threats such as business email compromise (BEC) and conversation hijacking.
PhaaS kits package templates, hosting, automation, and evasion into subscription services, lowering the skill barrier and making large-scale campaigns easier to run. Many kits now incorporate adversary-in-the-middle (AiTM) techniques to bypass MFA, which increases the payoff of credential theft.
HTML attachments can render locally in a browser and execute embedded scripts that redirect users to credential-harvesting pages or load additional content dynamically. This can help attackers evade traditional URL rewriting and reputation checks that focus on visible links in the email body.
QR codes often appear as innocuous images embedded in PDFs or documents, so the destination URL may not be inspected the same way as a text link. Scanning also shifts the action to mobile devices or external browsers where corporate controls may be weaker.
Common indicators include unusual sign-ins (new locations/devices), repeated password reset attempts, unauthorized changes to inbox rules (forwarding, deletion), and outbound phishing or spam sent from internal accounts. These signals should trigger immediate triage and containment.
Focus on layered controls: strengthen email filtering and impersonation protection, add time-of-click URL analysis, harden identity (MFA, conditional access, risky sign-in monitoring), and automate response for high-confidence threats. Pair technical controls with recurring user training and clear reporting paths.
