Analysis of suspected phishing emails revealed that only 16% were genuinely malicious.

50% of law firms cited phishing as the top cybersecurity concern, a new category this year, surpassing ransomware and user behavior.

Among the unidentifiable phishing kits used by phishing sites, Evilginx accounts for 20%.

A significant portion of BEC targets are Danish, at 38%.

The Manufacturing sector was the prime target for email-based attacks in Q2 2025, accounting for 26% of all incidents.

Retail was the second most targeted sector for email-based attacks in Q2 2025, accounting for 20% of attacks.

Legal or HR notices account for 5% in phishing emails.

Travel-themed messages account for 10% in phishing emails.

Healthcare was the third most targeted sector for email-based attacks in Q2 2025, accounting for 19% of attacks.

Legal or HR notices account for 5% in phishing emails.

Compromised websites are the second most prevalent link delivery method, at 30%.

Swedish and Norwegian targets comprise a combined 19% of BEC targets.

Lumma Stealer is the most encountered malware family found in the wild during Q2 and is often delivered via malicious .docx, .html, or .pdf attachments, or through phishing links hosted on compromised or legitimate-looking cloud services such as OneDrive, and Google Drive.

Among the unidentifiable phishing kits used by phishing sites, Tycoon 2FA accounts for 10%.

Package delivery messages account for 5% in phishing emails.

Voice phishing (vishing) is on track to double last year’s volume by the end of 2025.

Urgency-based messaging is the second most tried approach in phishing emails, at 25%.

PDFs remain the preferred vehicle for delivering malicious attachments in phishing, at 64%.

The use of URL shorteners accounts for 7% of phishing delivery.

Norwegian language use in BEC scams is 1.5%.