49.7% of clicked phishing simulations mentioned HR.

Link usage accounted for 75% of phishing attempts in Q1 2024.

Internal communications are a significant driver of phishing failures. Emails impersonating internal teams, particularly HR and IT, received the most failures in phishing simulations.

PDF attachments are used in 36% of phishing attacks as favoured attachments

SVG files are used in 34% of phishing attacks as favoured attachments.

Callback phishing accounted for 16% of phishing attempts in Q1 2025.

People were more likely to click on links related to internal topics or impersonating known brands, accounting for 61.6% of clicks.

60.7% of the phishing simulations that were clicked mentioned an internal team.

Link usage dropped by 42% in Q1 2025 compared to Q1 2024.

In attachment-based campaigns, people were most likely to open certain file types: PDFs (53%), HTML files (28.5%), Word files (18.5%).

Smishing has rapidly grown to comprise over two-thirds of mobile phishing attacks. Specifically, SMS/text based phishing (Smishing) is now 69.3% of all mishing attacks.

Vishing (voice-call phishing) tactics grew by 28%.

In attachment-based campaigns, people were most likely to open certain file types: PDFs (53%), HTML files (28.5%), Word files (18.5%).

The top three QR codes scanned in simulations related to: A new drug and alcohol policy from HR (14.7%), A DocuSign for review and signing (13.7%), A Workday happy birthday message (12.7%).

"More than half" of the organizations surveyed confirmed they regularly experienced malware and phishing incidents.

Despite regularly experiencing malware and phishing incidents, 90% of respondents expressed confidence in their organizations' security measures.

"More than half" of the organizations surveyed confirmed they regularly experienced malware and phishing incidents.

The FBI received 193,407 complaints about phishing/spoofing in 2024 (versus 298,878 in 2023 and 321,136 in 2022).

Small and medium-sized retailers saw significant declines in phishing susceptibility due to training, dropping from 29.3% to 3.7% for small retailers and from 33.3% to 4.2% for medium-sized retailers

Social Engineering was the second-most common incident pattern in the region, with phishing appearing in 19% of breaches in EMEA.