Phishing Attacks Surge in Scale and Sophistication in 2025

Phishing attacks surged in sophistication and scale throughout 2025, driven by the proliferation of phishing-as-a-service kits and the exploitation of misconfigured email systems, according to reports from cybersecurity firms Barracuda Networks and Microsoft. These threats enabled attackers to impersonate legitimate organizations, bypass security measures and steal credentials from users across multiple industries.

The number of active phishing kits doubled during the year, making advanced tools accessible to less-experienced cybercriminals and allowing them to conduct large-scale campaigns, Barracuda analysts found. These kits incorporated artificial intelligence to generate realistic emails mimicking services like Microsoft and DocuSign, along with evasion tactics such as URL obfuscation, CAPTCHA manipulation and malicious QR codes embedded in messages. Common lures included payment and invoice fraud, voicemail notifications, human resources updates, password resets and shared document requests, which tricked users into clicking links, scanning codes or entering personal information.

Attackers increasingly targeted email routing vulnerabilities to make phishing messages appear...