Phishing 2025 – the threats you need to know

In 2025, phishing attacks are expected to become both more sophisticated and harder to detect. According to a recent analysis from Barracuda Networks Security experts are developing increasingly advanced techniques for cybercriminals to bypass security measures and create credible, personalized attacks.

“The most worrying thing is how adeptly attackers are exploiting our digital presence and behavioral patterns to create highly convincing attacks. Both individuals and businesses now need to realize that the threat landscape is not static but constantly changing,” says Peter Graymon, Head of the Nordics at Barracuda Networks.

Fishing as a service – a growing market

So-called Phishing-as-a-Service (PhaaS) is expected to account for half of all phishing attacks aimed at stealing login credentials by 2025 – up from 30 percent today. These services are also becoming increasingly sophisticated and are now targeting the theft of multi-factor authentication (MFA) codes, meaning even well-protected accounts are vulnerable.

More personal attacks play on emotions

Cybercriminals are increasingly analyzing their victims’ social media and communication history to create emotionally engaging messages. This is leading to more targeted attacks, with extortion and sextortion – threats that exploit personal information or images – becoming increasingly common.

The technology that helps phishers stay one step ahead

Cybercriminals refining their methods by using new technical tricks and exploiting legitimate platforms:

• ASCII-based QR codes and Blob URI links are created to evade detection by security software.
• Phishing content is moved from the email itself to attachments such as HTML– or PDF document.
• Legitimate content creation and publishing platforms are increasingly being used to spread malicious links.

What does this mean for companies and individuals?

Phishing attacks remains one of the most cost-effective cyber threats, with a high success rate. In 2024, Barracuda a rapid increase in attacks that leverage AI to create credible and personalized messages. This development is expected to accelerate in 2025.

“Protecting against these threats requires a combination of technical solutions and training. A strong security culture and multi-layered defense are absolutely essential to keep up with the attackers,” concludes Peter Graymon.

How to protect yourself

To reduce the risk of being affected by phishing attacks, businesses should:

• Train employees regularly about new types of threats and how to detect them.
• Use security solutions that can identify advanced phishing methods.
• Build a security culture where it is natural to report suspicious emails and activities.

The analysis is done by Barracuda security experts Saravanan Mohankumar and Ashok Sakthivel.