A report released earlier this year outlined how cyber email threats have evolved from volume-based attacks to precision-engineered campaigns, according to Sublime Security.

The agentic email security platform outlines how email threat campaigns across all sizes of organizations have become highly sophisticated in order to exploit human psychology and organizational trust.

The company identified five core threats reported in 2025:

BEC/Fraud – 32%
Credential phishing – 23.6%
Callback phishing – 15.9%
Malware/Ransomware – 5.3%
Spam – 4.7%

Business email compromise fraud was the number one threat using thread hijacking or fake threads, at nearly one in three confirmed threats. This occurs when “attackers insert themselves into legitimate email threads, often through compromised accounts, creating the appearance of continuing an authentic business discussion.”

Detection is a challenge because while the sender domain may be unfamiliar, the context and conversation history appear genuine.

BEC threats also included advanced fee fraud, brand impersonation, VIP/Executive impersonation, and employee impersonation that typically highlights a sense of urgency.

The top impersonated brands were SendGrid and the IRS.

By industry, energy and utilities and financial services were the most targeted with VIP impersonation, while hospitality and recreational and real estate received the most employee impersonation threats.

The top five industries targeted the most by BEC fraud include: agriculture, transportation and logistics, hospitality and recreation, infrastructure services, and retail and consumer services.

Credential phishing was the second biggest threat by volume. Companies reported attackers pivoted to using malicious calendar invites and QR codes which bypass traditional email security systems.

More than 20% of callback phishing were delivered via a calendar invite.

According to Sublime, the emails containing QR codes were “intentionally sparse and mainly served to move targets off the inbox and onto a personal mobile device, where corporate controls and monitoring are often weaker.”

Due to the explosive growth of QR codes used in these types of scams, Sublime Security recommends “email security solutions recognize QR codes and interpret their destinations (through redirects and gates).”

Malicious QR codes are especially hard to detect because traditional email security only analyzes text and URLS, not images and usually pivots the user to their mobile phone without the corporate security found on their company devices.

Callback phishing still remains high volume, compromising 57% of attacks.

Generative AI attacks gained momentum, 4.21% in Q1 to 19.29% in Q4.

In the past, substantial time was invested as the attackers studied a company’s communication styles, organizational charts, and business processes to maximize attack effectiveness, that is no longer the case due to GenAI.

Another area of vulnerability is data living off trusted sites (LOTS), such as GoogleDrive and One Drive, which totaled 12% of attacks.

The rise of evasion stacking, attacks that employ multiple evasion techniques simultaneously to maximize the likelihood of bypassing security controls, is also of growing concern and requires “behavioral and multi-stage analysis that can detect social engineering patterns regardless of the technical delivery method.”

New attack vectors are emerging, according to Sublime’s analysis, including attacks on lesser-targeted LOTS and SaaS-platforms. Small providers lack resources to monitor user-generated content. Vulnerable platforms include page and form builders, customer support platforms, document and file-sharing, and collaborative workspaces. The implication, is that security teams cannot rely on static blocklists of “known bad LOTS providers” and should implement behavioral and agentic detections that can identify suspicious patterns regardless of the hosting platform.

Another emerging email attack threat is email bombs where a target’s inbox is inundated with hundreds or thousands of automated messages used as a smokescreen to cover another attack.

Email security systems must become more nimble to adjust to the changing, more sophisticated nature of the threats. Security systems should monitor not only text and URLs, but also images and calendar security.