cyber.hendryadrian.com
Security Report · darkreading.com

Zscaler Report Finds Phishing Volume Down as Losses Rise

· Original article ↗

Summary

Zscaler’s 2026 report says phishing activity fell 20% in both 2024 and 2025, while campaigns became more targeted. FBI-reported phishing losses rose from $70 million in 2024 to $215 million in 2025.

Key points

  • Zscaler recorded a 20% drop in phishing activity in 2024 and another 20% in 2025, following a 58% rise in the year after ChatGPT’s release.
  • Zscaler researchers describe a shift from mass campaigns to more targeted attacks that require greater effort but may have higher conversion rates.
  • The article reports that FBI phishing complaints were flat from 2024 to 2025, while reported losses rose from $70 million to $215 million.
  • In 2025, phishing activity rose 66% in the services sector and 50% in government, while education-sector activity fell 66%.
  • Phishing activity fell 64% in Canada and 53% in Spain; Brazilian hosting rose 2,522%, while Hong Kong hosting fell 90%.
  • Of attacker IPs that hit Zscaler decoys, 76% came from AWS address space. Zscaler’s threat intelligence director said shared hosting can make IP blocklisting problematic.

Article Details

Publisher
Dark Reading
Report Period
2026 report covering phishing trends and activity in 2025, with comparisons to prior years
Scope
Phishing activity, hosting infrastructure, sector and country trends, and reported victim losses
Key Statistics
  • Phishing volume fell 20% in 2024 and another 20% in 2025, following a 58% rise in the year after ChatGPT’s release.
  • The FBI reported the same number of phishing complaints in 2024 and 2025, while reported losses rose from $70 million to $215 million; 2023 losses were $18 million despite 50% more complaints than in 2024 or 2025.
  • In 2025, phishing attacks rose 66% in the services sector and 50% in government, while education-sector attacks fell 66%.
  • Of the attacker IPs that hit Zscaler decoys, 76% came from AWS address space.
  • Brazilian phishing hosting rose 2,522% in 2025, while Hong Kong hosting fell 90%.
Recommendations
  • Prefer more specific threat information over IP blocklisting alone, particularly when shared hosting may cause collateral issues.

MITRE ATT&CK

T1566 · PhishingThe article describes phishing campaigns using lure emails; it does not specify a phishing sub-technique.

People

Brett Stone-GrossZscaler’s senior director of threat intelligence; discussed the shift toward targeted phishing and phishers’ use of cloud hosting.

Vendors

Amazon Web ServicesPhishers are also increasingly using cloud infrastructure, especially AWS, while countries like Canada and Spain saw major drops in activity and the services and government sectors saw sharp increases.ZscalerZscaler’s 2026 phishing report says phishing volume is falling, but attackers are shifting to more targeted, higher-conversion campaigns that cause greater losses.

Products

AWSPhishers are also increasingly using cloud infrastructure, especially AWS, while countries like Canada and Spain saw major drops in activity and the services and government sectors saw sharp increases.

Countries

AustraliaPhishing activity plummeted 64% in Canada, 53% in Spain, and around 33% in Australia, Germany, India, and the UK.CanadaPhishers are also increasingly using cloud infrastructure, especially AWS, while countries like Canada and Spain saw major drops in activity and the services and government sectors saw sharp increases.GermanyPhishing activity plummeted 64% in Canada, 53% in Spain, and around 33% in Australia, Germany, India, and the UK.Hong KongPhishers are also changing where they’re hosting their infrastructure, with Brazilian hosting rising a whopping 2,522%, and Hong Kong falling dramatically by 90%.IndiaPhishing activity plummeted 64% in Canada, 53% in Spain, and around 33% in Australia, Germany, India, and the UK.SpainPhishers are also increasingly using cloud infrastructure, especially AWS, while countries like Canada and Spain saw major drops in activity and the services and government sectors saw sharp increases.United KingdomPhishing activity plummeted 64% in Canada, 53% in Spain, and around 33% in Australia, Germany, India, and the UK.

Industries

EducationCertain industries experienced major swings in 2025, with services sector phishing attacks rising 66% and government attacks rising 50%, in contrast to education falling 66%.GovernmentPhishers are also increasingly using cloud infrastructure, especially AWS, while countries like Canada and Spain saw major drops in activity and the services and government sectors saw sharp increases.ServicesPhishers are also increasingly using cloud infrastructure, especially AWS, while countries like Canada and Spain saw major drops in activity and the services and government sectors saw sharp increases.

Related Articles