Hoxhunt reports AI-assistance indicators in phishing rose to 56% in December

Summary

Hoxhunt reports that phishing samples with indicators of AI assistance rose from 4% in November 2025 to 56% in December, then fell to 40% in January 2026. The report also examines phishing tactics and training outcomes.

Key points

Hoxhunt found possible AI-assistance indicators in 4% of observed phishing samples in November 2025, 56% in December, and 40% in January 2026. Its analysis examined surface clues in emails and landing pages, not AI use behind the scenes or in other channels.
In analyzed likely AI-assisted emails, 43.1% used links, 11% used attachments, 20.3% used open redirects, and 4.9% included a malicious phone number.
Hoxhunt's calendar-invite simulations had failure rates 4–6 times the global baseline, reaching 24%. The report warns that a suspicious calendar event may need to be deleted separately from its email.
Hoxhunt says malicious SVG attachments increased fifty-fold from 2024 and made up 5% of malicious attachments in 2025; PDFs accounted for 23.7% in the first half of 2025.
The report methodology cites 50 million phishing simulations and millions of real malicious-email reports from 2.5 million users in 125 countries; its introduction says the data involved over 4 million users.
Hoxhunt reports that the share of users who had reported at least one real threat rose from 13% at the start of training to 64% after 12 months and 71% after 24 months.

Article Details

Publisher: Hoxhunt
Report Period: 2025–2026; AI phishing samples from November 2025 through January 2026
Scope: Global phishing attacks that bypass email filters, simulated phishing and employee training outcomes.
Sample Size: The introduction cites over 50 million data points from more than 4 million users. The methodology instead cites 50 million simulations and millions of reported malicious emails sent to 2.5 million users in 125 countries.
Key Statistics: Among sampled reported phishing emails, the proportion with indicators of AI assistance rose from 4% in November 2025 to 56% in December, then fell to 40% in January 2026. November's sample was smaller than those for December and January.
In Hoxhunt's November–December analysis of likely AI-assisted phishing, 43.1% of emails used links, 11% used attachments, 20.3% used open redirects and 4.9% included a malicious phone number.
Calendar-invite phishing simulations produced failure rates of up to 24%, four to six times the global baseline.
Malicious SVG files increased fifty-fold in 2025 compared with 2024 and represented 5% of malicious attachments in Hoxhunt's dataset.
In Hoxhunt's training data, the share of users who had reported at least one real threat increased from 13% at the start of training to 64% after 12 months.
Recommendations: Delete suspicious calendar events separately after reporting the associated email.
Tailor phishing training to employees' roles, skills and local working conditions.
Encourage threat reporting and automate the reporting workflow to help security teams block malicious emails and links.