We’ve all seen those fake bank emails or dodgy parcel texts. But phishing has grown up.
According to Proofpoint’s Human Factor 2025, the scams catching people out today don’t look suspicious at all. They look familiar. Trusted. Routine.
And that’s exactly the problem.
The quiet shift: from files to links
Attackers used to rely on attachments to deliver malware. Now, it’s all about links.
Proofpoint found that URLs are used four times more often than attachments in malicious emails. These links can appear as “View Document,” “Update Now,” or “Sign In” buttons – even hosted on legitimate services like OneDrive, SharePoint, Dropbox, or Google Drive.
When something looks normal, people click without hesitation. That one click can be enough to hand over logins, access, or control.
Over just six months, Proofpoint tracked 3.7 billion URL-based phishing attempts designed to steal credentials. By comparison, only 8.3 million were intended to deliver malware. Attackers have realised there’s an easier route: impersonate you, not infect you.
The rise of the “realistic” phish
The quality of modern phishing emails is staggering.
AI tools now generate perfectly written lures, spoofed brand logos, and fake login pages that even trained eyes struggle to spot. And it’s not just happening by email anymore – these scams are turning up in Teams chats, LinkedIn messages and text conversations.
The biggest driver behind this change? Human psychology.
Attackers play on instinct: curiosity, urgency, fear of missing out, or the desire to fix a problem fast. That’s why new techniques like ClickFix work so well.
These attacks show a fake Windows or browser update, convincing users to copy and run malicious code. Proofpoint reports that ClickFix campaigns have jumped by 400% year-on-year, spreading malware and remote access tools hidden behind “error” messages.
QR codes and text scams: the perfect disguise
QR codes and smishing (SMS phishing) have become the go-to tactics for reaching people directly.
In 2025 alone, Proofpoint saw 4.2 million QR code-based attacks – and over 55% of smishing messages carried malicious URLs.
Scammers exploit our habits. We trust QR codes in restaurants, posters and deliveries. We’re more likely to read a text than an email. And we’re wired to respond fast when something looks urgent – “Missed delivery,” “Congestion charge payment due,” or “Account locked.”
It’s social engineering at its finest. And it’s working.
What happens after the click
Phishing is rarely the end goal, it’s just the start of the attack chain.
That link might lead to a fake login page, a malware loader, or remote access software disguised as a help tool. From there, attackers can steal data, move laterally through systems, or trigger ransomware.
Proofpoint found that 34% of URL-based phishing campaigns delivered remote access software -legitimate tools repurposed by criminals to spy, steal, or install follow-on malware.
Once they’re in, they don’t need your password again. They already are you.
What organisations can do
You can’t rely on filters alone – some URLs only become malicious after delivery.
What helps is a mix of click-time protection (isolating or rewriting URLs in real time) and security awareness training that goes beyond tick-box exercises.
At Black Swan Cyber Security Solutions, we focus on helping people recognise the signals – a small pause before a big problem.
We also recommend pairing awareness with strong technical layers like endpoint detection (EDR/MDR), patch management, and domain protection. Together, these form a safety net when if someone clicks.
| Threat type | Key finding |
|---|---|
| URL-based threats | 4× more common than attachments |
| Smishing (SMS phishing) | 55% of messages contain malicious URLs |
| ClickFix campaigns | ~400% year-on-year increase |
| QR code attacks | 4.2 million detected in H1 2025 |
| Credential theft vs malware | 3.7 billion vs 8.3 million URL-based attempts |
| Remote access software delivery | 34% of URL-based campaigns deliver remote access tools |
The data is clear: today’s attacks target people, not just machines.
Every inbox, every smartphone, every QR code scan is a potential entry point – but also a chance to stop an attack before it starts.
Technology alone can’t fix human nature. But awareness, culture and layered protection can make that single click a lot less costly.
If you’d like to understand how well your business or school could withstand a phishing attack, we offer a Phishing Risk Audit.
We’ll help your team spot the lures, protect the click and close the gap before attackers exploit it. Please get in touch if you would like to learn more.
