The report contains statistics on spam and phishing in 2025, outlining the main trends: phishing and scam QR codes, ClickFix attacks, ChatGPT subscription lures and others.

Securelist is a cybersecurity blog and research platform operated by Kaspersky Lab. It offers insights, analysis, and reports on cybersecurity threats, vulnerabilities, and malware campaigns. Developers can learn about emerging cyber threats, security best practices, and mitigation strategies to protect their applications and systems. Additionally, Securelist provides insights into cybersecurity trends, threat intelligence, and industry developments, offering resources for cybersecurity professionals.

Securelist

Kaspersky's 2025 spam and phishing report reveals 554 million blocked phishing attempts and 144 million malicious email attachments. Key trends include QR code exploitation in phishing campaigns, ClickFix attacks instructing users to run malicious scripts, ChatGPT subscription lures, and sophisticated KYC credential harvesting. Attackers increasingly impersonated government services, messaging apps (WhatsApp, Telegram), and leveraged legitimate platforms (Google services, OpenAI) for distribution. Russia remained the top spam source (32.5%), while entertainment, employment, and investment themes dominated scam campaigns. BEC attacks evolved with fabricated email chains, and password-protected archives continued as primary malware vectors.

Kaspersky spam and phishing report for 2025

<p>I just despise SPAM…</p>
<p>Why can’t they just stop. Not only we don’t fall for it (hopefully usually) but also we start hating the products they’re pushing.</p>
