Notably, 70% of phishing emails successfully passed DMARC authentication, 41% were classified as spear-phishing and 38% contained novel social engineering techniques. One-third exceeded 1000 characters.<\/p>\n
More than 32 million high-confidence phishing emails were detected by Darktrace in 2025, showcasing a substantial escalation in identity-driven cyber threats.<\/p>\n
The data was collected by Darktrace from incidents across its global customer base and points to a year defined by automation, convergence and accelerating attacker speed.<\/p>\n
Over 8.2 million phishing emails targeted VIPs, accounting for more than 25% of all observed phishing attempts.<\/p>\n
Meanwhile, 1.6 million phishing emails originated from newly created domains and 1.2 million incorporated malicious QR codes.<\/a><\/p>\n Notably, 70% of phishing emails successfully passed DMARC authentication, 41% were classified as spear-phishing and 38% contained novel social engineering techniques. One-third exceeded 1000 characters.<\/p>\n The Darktrace report also showed how identity compromise has overtaken vulnerability exploitation as the dominant entry vector. Common Vulnerabilities and Exposures (CVE) increased by approximately 20% year-on-year (YoY), with exploitation often occurring before public disclosure.<\/p>\n "Identity has become the attacker's skeleton key. Instead of forcing their way through a firewall, adversaries are logging in with stolen credentials, hijacked tokens and abused permissions, then moving laterally under the cover of legitimacy," commented Shane Barney, CISO at Keeper Security.<\/p>\n "When identity controls are fragmented or overly permissive, attackers don't need novel exploits. They just need access that looks routine."<\/p>\nIdentity Compromise Dominant Entry Vector <\/strong><\/h2>\n
![\"Darktrace](\"https:\/\/assets.infosecurity-magazine.com\/content\/span\/336fc7b4-507d-49d3-be2f-2fe7cc02f6cd.png\")