Among the unidentifiable phishing kits used by phishing sites, other generic kits account for 5%.

For Business Email Compromise (BEC) attacks, English-speaking executives remain the most targeted at 42%.

Norwegian language use in BEC scams is 1.5%.

Among the unidentifiable phishing kits used by phishing sites, Evilginx accounts for 20%.

After CEOs and executives, the remaining BEC impersonation efforts are aimed at directors and managers (9%), HR personnel (4%), IT staff (3%), and school heads (2%).

Among the unidentifiable phishing kits used by phishing sites, Tycoon 2FA accounts for 10%.

Package delivery messages account for 5% in phishing emails.

Swedish and Norwegian targets comprise a combined 19% of BEC targets.

Lumma Stealer is the most encountered malware family found in the wild during Q2 and is often delivered via malicious .docx, .html, or .pdf attachments, or through phishing links hosted on compromised or legitimate-looking cloud services such as OneDrive, and Google Drive.

Healthcare was the third most targeted sector for email-based attacks in Q2 2025, accounting for 19% of attacks.

Retail was the second most targeted sector for email-based attacks in Q2 2025, accounting for 20% of attacks.

For phishing delivery, the majority (54%) of cybercriminals leveraged open redirect mechanisms.

Travel-themed messages account for 10% in phishing emails.

Impersonation is the most common technique in BEC scams, with 82% of attempts targeting CEOs and executives.

Urgency-based messaging is the second most tried approach in phishing emails, at 25%.

Travel-themed messages account for 10% in phishing emails.

Compromised websites are the second most prevalent link delivery method, at 30%.

Legal or HR notices account for 5% in phishing emails.

Legal or HR notices account for 5% in phishing emails.

Phishing and deception made up 31.6% of traffic on DNSFilter's network, marking an increase compared to the prior quarter. This amounted to over 750 million queries.