PDFs comprised the majority, 61.1%, of the top 20 attachments clicked in phishing simulations.

PDF attachment clicks in phishing simulations increased by 8.1% compared to Q1 2025.

71.9% of interactions with malicious landing pages involved branded content.

Among internally-themed links, 68.2% utilised domain spoofing techniques.

Internal-themed topics accounted for 98.4% of the top 10 most-clicked email templates in the phishing simulations.

IT-related themes were cited in 21.5% of phishing failures.

80.6% of the top 20 clicked links originated from internally-themed simulations.

80.6% of the top 20 clicked links originated from internally-themed simulations.

PDF attachment clicks in phishing simulations increased by 8.1% compared to Q1 2025.

Most phone numbers found in email threats leveraging the TOAD social engineering technique are Voice over Internet Protocol (VoIP) numbers.

A significant portion of email threats with PDF payloads persuade victims to call adversary-controlled phone numbers, employing Telephone-Oriented Attack Delivery (TOAD) or callback phishing.

NortonLifeLock, PayPal, and Geek Squad were among the most impersonated brands in TOAD emails with PDF attachments

Microsoft and Docusign were among the most frequently impersonated brands in phishing emails with PDF attachments.

Phone numbers are sometimes reused on consecutive days in TOAD attacks.

Phishing was the most costly attack vector, with $395,063,695 stolen across 52 on-chain security incidents in Q2 2025.

Phishing currently accounts for the highest number of security on-chain security incidents so far in 2025 (30/06/2025) in H1 2025.

Phishing was the second most costly, with $410,747,038 stolen across 132 on-chain security incidents in H1 2025.

ClickFix became the second most common attack method after phishing.

44.7% of respondents cited phishing/social engineering as a top concerning threat.

44.7% of respondents cited phishing/social engineering as a top concerning threat.