2025年网络威胁情报报告_51页_3mb

Cyber Threat Intelligence Report Summary (2025)

Core Content

This report provides a comprehensive overview of the evolving cyber threat landscape in 2025, focusing on the effectiveness of social engineering and phishing techniques that bypass traditional security filters. It highlights the shift in tactics from AI-generated deepfakes to more subtle, traditional impersonation methods that are enhanced by AI for better realism and credibility. The report also emphasizes the need for updated security awareness and technical defenses to counter these increasingly sophisticated threats.

Main Points

1. Threat Landscape Overview

• Traditional Techniques Dominate: Despite the hype around AI-generated deepfakes, most phishing attacks in 2025 relied on traditional methods like impersonation and deception, adapted to bypass modern filters.
• AI Enhances Phishing Quality: Generative AI has significantly improved the quality of phishing emails, making them more grammatically correct, visually polished, and aligned with everyday business communication.
• Social Engineering Expands: Social engineering tactics are no longer limited to email but have expanded into social media platforms, recruitment channels, and other professional communication environments.

2. Key Developments in Phishing

• Fluent Phishing: Phishing emails now have near-perfect grammar and formatting, making them harder to detect by relying on traditional "look for typos" methods.
• Adversary-in-the-Middle (AitM) Phishing: AitM toolkits have become more common, enabling attackers to intercept login sessions, capture session tokens, and bypass MFA.
• Social Media Integration: Phishing campaigns increasingly use social media links and platforms to manipulate professional identities and trigger emotional responses.

3. Top Entities Impersonated

• Microsoft: Continues to be a primary target due to its widespread use and perceived authority.
• Human Resources: Attackers often impersonate HR to trick employees with false salary or bonus information.
• Supply Chain Third Parties: Phishing emails from look-alike domains or compromised accounts are used to exploit trust and familiar workflows.

4. Emotional Triggers in Phishing

• Urgency: A common tactic to pressure recipients into quick action.
• Curiosity: Used to entice users to click on links or download attachments.
• Trust: Exploiting the trust in organizational figures or legitimate services.
• Approval: Leveraging the desire for recognition or validation.
• Reward-Seeking: Encouraging users to engage with lures by offering benefits or incentives.

5. Attachment-Based Phishing Trends

• PDFs Remain Dominant: Accounted for 23.7% of phishing attachments in H1 2025, often containing fake invoices or misleading documents.
• SVGs Rise Dramatically: SVG attachments increased by 50 times compared to 2024, due to their ability to bypass filters and contain embedded malicious code.
• QR Codes Decline: QR codes in phishing emails dropped from 20% in 2023 to less than 2% in H1 2025, likely due to improved detection and attacker adaptation.

6. Link Shorteners and Document Sharing Services

• Twitter (t.co) and Bitly (bit.ly): These remain the most popular link shortening services used in phishing.
• Dropbox: Is the most commonly used document sharing service in phishing attacks.
• Social Media Links: Increased by 600% in phishing emails since 2023, often used in campaigns that exploit compromised business emails.

7. Campaign Examples

• Microsoft Impersonation: Emails mimicking security alerts or full mailbox warnings are common, often with AI-generated visuals.
• Fake Email Threads: Attackers create fake email chains to impersonate internal figures, making the request for payment or document review seem credible.
• Recruitment Scams: Phishing emails impersonating HR or recruitment services are used to trick employees into sharing sensitive information.
• Supply Chain Fraud: Emails from compromised organizational accounts or look-alike domains are used to manipulate invoicing and delivery processes.

8. Industry and Regional Trends

• Industry-Specific Campaigns: Certain sectors like hospitality, finance, and technology are targeted more frequently, with examples like Booking.com and HSBC impersonations.
• Regional Variations:
  • North America: Voicemail and fake subscription renewal attacks are more prevalent.
  • Asia-Pacific: Business opportunity lures, such as low-interest loans or investment schemes, are more common.
  • Europe: Financial institution impersonation is a major tactic, exploiting trust in traditional banks.

9. Strategic Guidance

• Behavioral Training: Organizations should train employees to question routine requests, not just urgent or error-filled ones.
• Phishing-Resistant MFA: Traditional MFA methods are no longer sufficient; phishing-resistant alternatives are necessary.
• Token-Centric Defenses: Binding tokens to devices and shortening session lifetimes can help prevent session token theft.
• “Pause → Verify → Act” Culture: Encouraging employees to verify the legitimacy of requests before acting is critical for reducing human risk.

Key Information

• Data Source: The report is based on user-reported phishing emails that bypassed filters, collected by Hoxhunt between January and June 2025.
• Impact of AI: AI improves the quality and realism of phishing content, making it harder to detect based on traditional indicators like typos.
• Adversary-in-the-Middle (AitM) Kits: These allow attackers to intercept and steal session tokens, even bypassing MFA.
• SVG Attachments: A significant threat due to their ability to bypass filters and contain malicious code.
• Human Risk: Employees remain the weakest link, and training must focus on behavior, not just technical detection.

Conclusion

The 2025 threat landscape is characterized by a blend of traditional and AI-enhanced phishing techniques. Attackers are increasingly leveraging trust, routine, and emotional triggers to manipulate users. Organizations must update their security awareness programs and technical defenses to include behavioral training, phishing-resistant MFA, and token-based incident response to effectively counter these threats. The report underscores that while AI improves the sophistication of phishing attacks, the core strategies remain rooted in social engineering and human psychology.