Top 70 Phishing Statistics and Trends You Must Know in 2025

Phishing remains one of the biggest cyber threats in 2025, evolving with AI tools and targeting businesses and individuals alike. With phishing emails contributing to a significant number of data breaches, it's essential to stay updated on the latest phishing statistics and phishing trends. Let’s dive into the current phishing insights and trends shaping cybersecurity in 2025.

Key Phishing Statistics in 2025

Phishing remains a primary attack method, as most cyberattacks begin with a phishing email.

According to GreatHorn, 57% of organizations face phishing scams weekly or daily. Nearly 1.2% of all emails sent are malicious, accounting for 3.4 billion phishing emails daily.

Human error continues to play a significant role, contributing to 60% of security breaches, according to the Verizon Data Breach Investigations Report (DBIR) 2025.

Meanwhile, CSO Online reports that 80% of security incidents are attributed to phishing, with losses totaling $17,700 every minute due to these attacks.

Phishing Trends in 2025

As phishing tactics become more sophisticated, several key phishing trends have emerged in 2025:

1. Targeting Financial Institutions: APWG reports that 23% of phishing attacks in Q2 2023 were aimed at financial institutions, with social media platforms and SaaS companies accounting for 22.3% each.
2. Deceptive Links Dominate: Cloudflare reports that deceptive links were the most common phishing method, making up 36% of phishing threats from their analysis of 13 billion emails.
3. Brand Impersonation: Attackers frequently impersonate popular brands like Microsoft, Google, and Amazon. According to Cloudflare’s phishing stats, 51.7% of malicious emails were disguised as communications from these companies.
4. AI-Driven Phishing: AI-powered phishing attacks are harder to detect as attackers use AI to craft human-like messages. Zscaler ThreatLabs indicates that this trend is on the rise, making it harder for conventional security measures to block these attacks.
5. Ransomware via Phishing: 35% of ransomware attacks are initiated through phishing emails, showing how critical email security has become in mitigating ransomware attacks.
6. AI-Powered Email Scams: Attackers now use AI chatbots to generate typo-free and convincing phishing emails, mimicking legitimate messages almost perfectly (Source).
7. Abuse of Cloudflare Services: Hackers are misusing Cloudflare Workers and Pages to host phishing payloads, making the phishing emails appear more legitimate (Source).
8. Smishing by Organized Groups: The “Smishing Triad” and similar threat actors have escalated global SMS phishing, using over 200,000 fraudulent domains (Source).
9. Phishing as the Leading Ransomware Vector: 45% of ransomware infections now originate from phishing emails (Source).
10. Hyper-Personalized AI Phishing: AI-driven scams now use publicly available personal data to craft emails that impersonate friends or family, deceiving even cautious users (Source).

70 Current Phishing Statistics Insights

In 2025, phishing remains one of the most dangerous and widespread cyber threats. Many of the biggest cyber attacks in history involved phishing as a key entry point. From traditional email-based attacks to more sophisticated methods like voice phishing (vishing) and SMS phishing (smishing), organizations across all industries are struggling to defend against these constantly evolving tactics.

Here are the 70 most critical phishing statistics defining the current cyber landscape, including new insights from Keepnet's research on social engineering threats like vishing.

1. 57% of organizations experience phishing attacks daily or weekly (GreatHorn).
2. According to Keepnet, new hires are 44% more likely to fall victim to phishing and social engineering attacks during their first 90 days.
3. 1.2% of all emails sent daily are malicious, equating to 3.4 billion phishing emails (APWG).
4. 74% of security breaches involve human error or social engineering (Verizon DBIR 2023).
5. Phishing initiates 41% of cyber incidents (IBM).
6. 80% of reported security incidents are caused by phishing (CSO Online).
7. Businesses lose $17,700 per minute due to phishing attacks (CSO Online).
8. 23% of phishing attacks target financial institutions, with 22.3% aimed at social media and web-based services (APWG).
9. Deceptive links account for 36% of phishing threats (Cloudflare).
10. 51.7% of malicios emails impersonate major brands like Microsoft and Google (Cloudflare).
11. 35% of ransomware attacks originate from phishing emails (Cloudflare).
12. AI-powered phishing is becoming harder to detect, with AI-generated messages that mimic human behavior (Zscaler).
13. A new phishing website appears every 20 seconds worldwide (DataProt).
14. 36% of data breaches in the US are caused by phishing (Verizon DBIR 2023).
15. 91% of security managers doubt the effectiveness of traditional security training against phishing (Cloudflare).
16. 493.2 million phishing attacks were reported in Q3 2023, a 173% increase from Q2 (Cloudflare).
17. Facebook was the most impersonated brand in phishing URLs in 2023 (Cloudflare).
18. 89% of malicious emails bypassed email authentication methods like SPF, DKIM, and DMARC (Cloudflare).
19. 35.6% of phishing attacks involve clicking on malicious links, making them the top delivery method (CrowdStrike).
20. 50% of phishing emails now include attachments like PDFs or QR codes, which are harder to detect (Cloudflare).
21. 70% of organizations unknowingly share sensitive information during vishing (voice phishing) simulations, according to Keepnet 2024 Vishing Response Report.
22. On average, vishing attacks cost organizations $14 million annually, highlighting the financial toll of phone-based fraud (Keepnet).
23. Customer support departments were identified as the most vulnerable to vishing attacks, with their high volume of external communications making them primary targets (Keepnet).
24. 6.5% of users were deceived by simulated vishing calls, indicating the need for enhanced security training (Keepnet).
25. 40.3% of users did not answer vishing calls, which could either show caution or lead to potential security risks due to missed warnings (Keepnet).
26. Companies with the lowest vishing rates typically use advanced vishing simulation software, demonstrating the effectiveness of proactive training (Keepnet).
27. Vishing attacks have increased by 30% in the last year, showing the growing use of phone-based social engineering (Keepnet).
28. 76% of businesses were hit by smishing (SMS phishing) or scam text messages in the past year, resulting in a 328% increase in incidents and average losses of $800 per incident globally (Keepnet).
29. Phone scams caused $39.5 billion in losses last year, with vishing emerging as one of the most damaging forms of fraud (Keepnet).
30. Senior citizens were disproportionately targeted by vishing, with a 40% increase in attacks in the last two years, making them a key demographic for scammers (Keepnet).
31. In January 2025, nearly half of all phishing emails (48%) contained malicious attachments.
32. 45% of cyber security leaders rank ransomware as the top organizational cyber risk.
33. 20% cyber security leaders identify cyber-enabled fraud (phishing, BEC, etc.) as their top risk.
34. 17% cyber security leaders list supply chain disruption as their top concern.
35. 2025: 37% cite identity theft as top concern; 24% compromised personal data; 20% cyber extortion; 20% loss of utilities.
36. 47% of organizations highlight AI-enhanced adversarial capabilities as their main GenAI security concern.
37. 42% of organizations experienced a phishing/social engineering attack in 2024 (and many expect this to grow with AI tools).
38. Dark-web trade in deepfake tools rose 223% (comparing Q1 2023 to Q1 2024).
39. 55% of CISOs polled (2024) see deepfakes as a moderate-to-significant threat.
40. Cybercriminal “scam-farms” have collectively stolen more than in the 12 months before mid-2024.
41. In January 2025, nearly 48% of phishing emails contained malicious attachments.
42. 45% of cybersecurity leaders now rank ransomware as their top risk.
43. 20% rank phishing and BEC as the top cyber-enabled fraud risk.
44. 37% cite identity theft; 24% compromised data; 20% cyber extortion and utility loss as 2025's top cybersecurity concerns.
45. 47% of organizations identify AI-powered threats as their GenAI security concern.
46. 42% experienced phishing/social engineering attacks in 2024, with more expected due to AI.
47. The dark web trade in deepfake tools rose 223% between Q1 2023 and Q1 2024.
48. 55% of CISOs consider deepfakes a moderate-to-severe threat.
49. Cyber scam farms have stolen more in the last 12 months than in any prior year (Keepnet).
50. Ransomware was involved in 44% of breaches, with a median payout of $115K and 64% refusing to pay.
51. 30% of breaches were caused by third-party compromise.
52. 22% of breaches started with stolen credentials, and 20% from exploited vulnerabilities.
53. Edge and VPN vulnerabilities grew eightfold, with only 54% patched, and a median fix time of 32 days.
54. Human error contributed to 60% of breaches, while user reporting increased 4x post-training.
55. Espionage-related breaches rose by 163%, now 17% of all incidents.
56. Infostealers hit 30% of corporate and 46% of unmanaged devices storing credentials.
57. 15% of staff accessed generative AI tools, 72% through personal email accounts.
58. Business Email Compromise (BEC) losses totaled $6.3 billion, with a $50K median loss per incident.
59. The use of AI-generated phishing emails has skyrocketed by over 4,000% since 2022, as attackers increasingly deploy large language models to mimic natural communication and evade detection systems. (Source)
60. As of 2024, Google's AI-driven email security systems block approximately 15 billion unwanted emails daily, effectively preventing over 99.9% of spam, phishing attempts, and malware from reaching users' inboxes, demonstrating the escalating volume of email-based threats and the need for layered security defenses. (Source)
61. Business Email Compromise (BEC) schemes are responsible for 28% of all phishing-related financial losses, with each successful incident costing organizations an average of $187,000. (Source)
62. Corporate executives are being specifically targeted by AI-powered phishing campaigns, which now use advanced personalization to create high-trust email messages that bypass traditional filters (Financial Times).
63. In 2024 alone, victims reported $16.6 billion in cyber fraud losses, marking a 33% rise from 2023, with phishing continuing to dominate as the most reported scam tactic (Source).
64. A global workforce survey in 2024 found that 45% of professionals had fallen victim to a cyberattack or online scam, many of which stemmed from email-based phishing (New York Post).
65. In Q1 2024, the Anti-Phishing Working Group (APWG) recorded 963,994 phishing attacks, marking a significant decrease from the record high of 1,624,144 attacks observed in Q1 2023. (Source)
66. Once launched, the average phishing campaign operates undetected for 96 hours, allowing bad actors critical time to harvest credentials and spread malware before takedown (SQ Magazine).
67. Smartphones are now a common vector for attacks, with 28% of phishing emails being accessed on mobile devices, making mobile security more important than ever (Source).
68. Phishing surges are notably tied to crisis events, with email-based attacks spiking up to 68% in impacted regions during periods of global unrest or emergencies (Source).
69. Financial institutions remain the most frequently spoofed sector, accounting for 33% of phishing attempts, due to the high trust users place in banking-related communications (Source).
70. Phishing emails that use psychological pressure such as urgency or fear achieve an 18% click-through rate, proving emotional manipulation remains a powerful attack strategy (Source).

These phishing stats show just how widespread and damaging phishing attacks have become. From email-based phishing to advanced methods like vishing and smishing, or deepfake phishing attacks, organizations must remain vigilant and proactive. Implementing phishing simulations, vishing simulations, and security awareness training can drastically reduce the risks associated with these cyber threats. Keepnet Human Risk Management offers businesses the tools they need to stay protected and avoid costly data breaches and financial losses.

Phishing Attacks That Caused Serious Harm in 2025

Here are three examples of significant phishing attacks from 2025:

1. Twilio Phishing Attack: Twilio’s systems were breached through a sophisticated spear-phishing campaign, compromising sensitive customer data.
2. SOVA Android Malware via Phishing: This malware was distributed through phishing emails, leading to ransomware demands and file encryption on victims' devices.
3. Petya Ransomware Resurgence: Petya ransomware re-emerged in 2024, targeting businesses via phishing emails and encrypting entire networks.
4. AI-Powered Phishing Campaigns Targeting Email Users: In early 2025, phishing scams using AI to generate convincing emails targeted Gmail, Outlook, and Apple Mail users, leading to a spike in identity theft and financial fraud. These AI-crafted messages mimicked legitimate communication, making detection extremely difficult. (Source)
5. Blob URI Phishing Technique Bypassing Security: In 2025, researchers discovered phishing attacks using browser-based blob URIs to steal encrypted login credentials. These phishing pages bypass traditional security and AI filters, making them nearly invisible to detection tools. (Source)
6. WhatsApp 'Funny Meme' Scam: In 2025, a WhatsApp scam used seemingly harmless memes to spread malware. Once downloaded, these images gave hackers access to victims’ personal data and bank details. (Source)

Further Reading

Phishing continues to be a major cyber security threat in 2025, with the sophistication and frequency of attacks rising. As phishing accounts for a large portion of data breaches, organizations must invest in phishing simulations and awareness training to reduce the risks. The evolution of AI-driven phishing and multi-channel attacks makes it imperative to adopt advanced security measures.

Train your employees and secure your business with Keepnet's phishing simulation tools, increasing awareness by up to 90%. Protect your organization with Keepnet's incident response and threat intelligence solutions to stay ahead of the latest phishing threats.

For more resources and insights into phishing and cybersecurity, check out the following blogs:

1. Cybersecurity Awareness Training for Employees

Learn how to equip your team with the knowledge and skills to identify and avoid phishing attacks, improving your overall security posture and get free cybersecurity awareness training contents.

2. What Are Vishing Statistics in 2025?

Examine the growing threat of voice phishing (vishing) and how it is impacting businesses today.

3. 2025 QR Code Phishing Trends: In-Depth Analysis of Rising Quishing Statistics

Learn how quishing—phishing via QR codes—is becoming a more prevalent attack method in today’s digital world.

4. 2025 Security Awareness Training Statistics

Understand the latest trends and statistics around security awareness training and its effectiveness in preventing cyber incidents.

5. Smishing Statistics: The Growing Threat of SMS Phishing

Dive into the alarming rise of smishing (SMS phishing) and what businesses need to do to protect their employees from this attack vector.

6. Understanding MFA Phishing: Protection Measures and Key Statistics

Explore how multi-factor authentication is being targeted by threat actors and what steps you can take to bolster your defenses.

7. Understanding MFA Phishing: Protection Measures and Key Statistics

Explore how attackers exploit multi-factor authentication and what can be done to enhance your defenses.

8. Top 10 Effective Vishing Awareness Training Strategies for Your Team

Learn practical strategies for training your team to recognize and prevent vishing attacks.

9. Email Security: The 7 Biggest Threats

Discover the most common email security threats and how to strengthen your organization’s email defenses.

10. How to Protect Your Business Against Ransomware

Explore key steps for safeguarding your company from ransomware, a threat often initiated by phishing emails.

By staying proactive and informed, your organization can significantly reduce its exposure to phishing scams and build a robust cybersecurity strategy.

Editor's Note: This article was updated on June 24, 2025.