Users receive at least one advanced phishing link every week
Phishing remains one of the most significant cyber threats impacting organizations worldwide, according to SlashNext.
Credential phishing is raising
Credential theft attacks surged dramatically in the second half of 2024 (703%), signaling a sharp escalation in the use of sophisticated phishing kits and social engineering tactics. These attack methods frequently overlap, as many credential phishing attempts incorporate malicious links as part of their strategy.
Overall, email-based threats rose by 202% in the latter half of the year, with individual users receiving at least one advanced phishing link per week capable of bypassing traditional network security controls.
Of all embedded malicious links observed, 80% were previously unknown zero-day threats—underscoring the limitations of static threat intelligence and signature-based detection methods.
During peak periods, users faced an average of 3-6 threats per week, and annually, up to 600 mobile threats per user. Social engineering-based attacks rose by 141% in the last six months, reinforcing the need for real-time, adaptive security measures.
“In early 2024, we witnessed a sharp spike in attacks as adversaries quickly learned to integrate AI into their phishing strategies, resulting in far higher volumes of advanced and effective threats,” said Stephen Kowski, Field CTO, SlashNext. “By the second half of the year, the growth in attack volume was more gradual but still persistent. We fully anticipate this upward trajectory will continue into 2025, especially as our threat research team uncovers new, advanced phishing kits freely available on the Dark Web.”
AI-generated attacks becoming more sophisticated
Looking ahead to 2025, we expect this evolution to accelerate, with AI-generated attacks becoming more sophisticated and harder to detect, while attackers increasingly target messaging platforms beyond email, including business collaboration tools, SMS, and social media.
The bottom line is phishing isn’t an email-only problem anymore; it is a broader messaging security problem that requires a fundamental shift in how organizations approach threat detection and prevention.
The volatile nature of threat categories—ranging from novel phishing links and cleverly disguised attachments to expertly engineered natural language scams—means that what’s effective for attackers can change on a near-weekly basis.
“Traditional security measures are overwhelmed by the sheer volume and adaptability of these threats,” continued Kowski. “Organizations need a comprehensive, proactive security strategy backed by real-time detection and mitigation technologies to stay ahead of increasingly agile attackers.”