Phishing attacks continue to grow in sophistication, using artificial intelligence, deepfake technology, and advanced social engineering tactics to trick individuals and businesses into revealing sensitive information. In 2024 alone phishing was responsible for 20% of all data breaches and experts predict this trend will continue in 2025.
With cyberthreats evolving in this blog, we will cover:
- The latest phishing techniques in 2025
- How to recognise a phishing attempt
- How to protect yourself
- What to do if you fall victim of a phishing attack
By understanding these evolving threats, you can strengthen your defences against one of the most persistent cybersecurity risks. We will start with the latest phishing techniques in 2025
Spear phishing with AI
Scammers are using AI, such as ChatGPT, to improve phishing attacks. While regular phishing sends generic messages, spear phishing targets specific individuals with personalised details to steal sensitive information. AI makes spear phishing more efficient, creating sophisticated, well-written emails in multiple languages. Soon, these attacks could resemble personalised ads, like fake VIP ticket offers designed to steal credit card info.
AI-Generated Phishing Emails
Every day, over 333 billion emails are sent and received worldwide. On average, employees receive around 120 emails daily, plenty of opportunities for cybercriminals to strike. And they’re getting smarter, AI-powered cyberattacks are on the rise, making phishing attempts more convincing than ever. Scammers can now generate email addresses that closely resemble those of your co-workers, managers, or trusted brands. These emails often contain no typos, no awkward phrasing, just polished, believable messages. This level of sophistication makes these threats especially dangerous. When an email looks legitimate, it’s much easier to trust and a single click or response can open the door to serious security risks.
Deepfake Voice & Video Scams
AI is also used to clone voices, making it possible for attackers to impersonate executives or colleagues to deceive employees into transferring funds or revealing confidential data. In one case, a CEO was tricked into transferring $243000 after receiving a call from someone impersonating their boss. Beyond financial theft, voice cloning can be employed in phishing schemes, where fraudsters convince targets to share sensitive information. As AI technology continues to advance, the threat landscape evolves, requiring robust security measures and constant vigilance to safeguard against such sophisticated attacks.
MFA Bypass Attacks
Despite Multi-Factor Authentication (MFA) being an effective way to protect organisations and reduce cyberthreats, it is not fool proof. According to Microsoft Expert director of Identity Security, cybercriminals use various techniques such as MFA fatigue, token theft, and man-in-the-middle attacks to bypass MFA.
One example of MFA fatigue occurs when cybercriminals repeatedly send MFA requests to a user, hoping they will eventually accept out of frustration. This tactic was used in the Uber breach case, where the attacker, having allegedly stolen an employee’s credentials through a malware attack, sent numerous push notifications and even posed as IT support persuading them to gain access. Similar methods have also targeted companies like Microsoft and Cisco.
How to recognise email phishing attempts
- Here are some red flags to watch out for in phishing emails and messages:
- Urgent language – “Your account has been compromised! Act now!”
- Suspicious links – Hover over links to check the actual URL before clicking.
- Unexpected attachments – Always verify before opening any unexpected files.
- Altered email addresses – Watch for subtle changes in email addresses (e.g., “paypa1” instead of “paypal”).
- How to Protect Yourself
Upgrade to AI-Powered Email Protection
To protect yourself from phishing attacks, use AI-powered email security solutions that analyse email content, sender behaviour, and contextual information. These advanced systems can detect subtle phishing signs and block malicious emails before they reach you. AI tools also integrate with other security measures, such as endpoint protection, firewalls, and threat intelligence platforms, enabling a comprehensive defence strategy.
Enable Stronger Multi-Factor Authentication
Using multi-factor authentication (MFA) is far more secure than relying on just a single factor like a password. MFA requires two or more authentication factors, such as a password combined with a biometric feature or a possession-based verification factor.
To enhance your security, follow the NIST password guidelines recently updated in August 2024. Some of the new guidelines recommend focusing on password length rather than complexity. So, consider using a longer password instead of just adding uppercase letters, numbers, and symbols.
Additionally, it’s crucial for enterprise access to support phishing-resistant MFA methods, which combine passwords or biometric features with asymmetric key cryptographic techniques.
Train Yourself and Others
Phishing attacks are not only a business risk but also affect individuals. Use platforms like KnowBe4 for security awareness training and educate your employees about potential threats like deepfake voice scams, spear phishing attacks and so on.
Verify Requests Before Taking Action
Don’t shy away from verifying a suspicious message by contacting the sender through official channels. Do not click on links or open attachments without confirming their legitimacy.
Report Phishing Attempts
If you encounter a phishing attempt, report it to your IT department, email provider, or security team. Forward suspicious emails to authorities like the Anti-Phishing Working Group.
What to Do If You Fall Victim to a Phishing Attack
If you’ve fallen victim to a phishing attack, acting quickly is critical to minimise potential damage. Below are some guide steps to follow:
- Update Your Passwords
If you suspect your account has been compromised, change your passwords immediately. This will prevent attackers from gaining further access, especially if you use the same password for multiple accounts. Remember, use unique passwords for every account whether personal or work-related. - Inform Your Bank
If you’ve shared sensitive financial information, such as bank details, contact your bank immediately to report the incident. They may freeze or monitor your accounts for fraudulent activity and help protect your funds. - Report the Phishing attack
If the attack occurred at work, notify appropriate people in your organisation, whether is your employer or IT department do it as soon as possible and follow your company’s incident response protocol. Early reporting allows the team to take appropriate measures to prevent further breaches. - Report to Relevant Authorities
If you’ve personally been affected, report the attack to the relevant authorities. In the UK, you can report phishing to Action Fraud, while in the US, the Federal Trade Commission (FTC) handles these types of cases. Prompt reporting helps authorities track cybercrime and protect others from similar attacks. - Scan Your Devices for Malware
If you suspect malware was installed on your device during the phishing attack, run a full system scan using trusted antivirus software. Ensure your security software is up to date to detect the latest threats. - Monitor Your Accounts
Regularly monitor your accounts for unusual activity, including bank statements, email accounts, and social media. This helps catch any unauthorised actions early and minimises damage.
Remember, prevention is key. Always be cautious of unsolicited emails, links, or attachments, and verify the sender’s identity before clicking. Being proactive about security can make all the difference.
Phishing tactics may be evolving, but with the right protective measures, you can stay one step ahead. By adopting AI-powered security tools, enabling stronger MFA, educating yourself and your team, and staying vigilant, you can significantly reduce your risk.
Need assistance in strengthening your security? Our expert team is ready to help you choose the right cybersecurity solutions tailored to your needs. Contact us today on +353 1 685 6191 or email us at ireland@infinigate.cloud and ensure you’re taking the necessary steps to stay secure.