For Business Email Compromise (BEC) attacks, English-speaking executives remain the most targeted at 42%.

The strategic use of Danish language in BEC scams is 11.9%.

Among the unidentifiable phishing kits used by phishing sites, 16shop accounts for 7%.

Among the unidentifiable phishing kits used by phishing sites, other generic kits account for 5%.

Impersonation is the most common technique in BEC scams, with 82% of attempts targeting CEOs and executives.

The most observed phishing exploitation mechanisms are HTTP POST to remote server accounting (52%) and email exfiltration (30%).

58% of phishing sites now use unidentifiable phishing kits.

After CEOs and executives, the remaining BEC impersonation efforts are aimed at directors and managers (9%), HR personnel (4%), IT staff (3%), and school heads (2%).

Travel-themed messages account for 10% in phishing emails.

For phishing delivery, the majority (54%) of cybercriminals leveraged open redirect mechanisms.

Account verification and updates account for 20% of approaches in phishing emails.

Swedish language use in BEC scams is 3.8%.

Financial lures are the number one ploy in phishing emails, representing 35% of samples.

From July 2024 to June 2025, Kaspersky experts detected over 650,000 attempts to visit phishing pages disguised as LinkedIn alone

Phishing and deception made up 31.6% of traffic on DNSFilter's network, marking an increase compared to the prior quarter. This amounted to over 750 million queries.

38% of organisations suffered a phishing attack that led to unauthorised access.

Subscription prices for generative AI tools like FraudGPT and WormGPT, marketed for illicit uses such as phishing and malware creation, start for as little as $200 per month.

71.9% of interactions with malicious landing pages involved branded content.

Internal-themed topics accounted for 98.4% of the top 10 most-clicked email templates in the phishing simulations.

HR-related themes were cited in 42.5% of phishing failures.