The number of phishing packages doubled in 2025 – threats are becoming more sophisticated

The number of known phishing-as-a-service (PhaaS) kits doubled in 2025, increasing the pressure on security teams trying to protect themselves against increasingly sophisticated attacks. It shows Barracudas annual phishing review for 2025.

New phishing kits like Whisper 2FA and GhostFrame introduced innovative and elusive methods, including techniques that make malware analysis more difficult. Meanwhile, established tools like Mamba and Tycoon continued to evolve and thrive, each kit responsible for millions of attacks.

The most common techniques in phishing packages in 2025 were:

• Multi-factor authentication bypass – used in 48 percent of attacks
• URL Spoofing – 48 percent
• Abuse of CAPTCHA to avoid detection – 43 percent
• Polymorphic techniques and malicious QR codes – each about 20 percent
• Malicious attachments – 18 percent
• Misuse of trusted online platforms and use of generative AI – 10 percent each

The topics used in phishing are largely the same as in previous years – but now they have been developed with the help of generative AI. In 2025, almost one in five (19 percent) phishing emails were about payment and invoice fraud. Digital signatures and document review accounted for 18 percent, while HR-related documents were present in 13 percent of cases. Many attacks exploited well-known brands and imitated websites and logos with increasing precision.

– Phishing packages took another step forward in 2025, both in number and sophistication. They function as complete attack platforms that make it possible even for less experienced cybercriminals to carry out powerful attacks at scale, says Ashok Sakthivel, Director of Software Engineering at Barracuda.

– To protect themselves, organizations must move away from static defenses and instead implement layer-based strategies in the form of user education, phishing-resistant MFA, continuous monitoring. At the same time, ensure that email security is a central part of an integrated, comprehensive security strategy, concludes Ashok Sakthivel.

Read more about phishing and developments in 2025 here"