Darktrace Reports 32 Million Phishing Emails Detected in 2025
Summary
Darktrace says it detected over 32 million high-confidence phishing emails in 2025 across its global customer base. Its findings point to identity compromise overtaking vulnerability exploitation, alongside regional trends in account takeovers, ransomware and AI threats
Key points
- Darktrace reported detecting more than 32 million high-confidence phishing emails in 2025; over 8.2 million targeted VIPs.
- The report says 70% of observed phishing emails passed DMARC, 41% were spear-phishing, and 38% used novel social engineering.
- It identified 1.6 million phishing emails from newly created domains and 1.2 million containing malicious QR codes.
- Darktrace’s findings indicate identity compromise overtook vulnerability exploitation as the dominant entry vector; the article cites stolen credentials, hijacked tokens and abused permissions.
- In the Americas, SaaS and Microsoft 365 account takeovers accounted for nearly 70% of incidents tracked by Darktrace.
- Darktrace reported a 60% year-over-year rise in ransomware in Africa; 76% of compromises there were classified as network-based.
- In Asia-Pacific and Japan, 84% of surveyed organizations said AI-powered threats were affecting them, while 42% reported formal policies for safe AI use.
Article Details
- Publisher
- Infosecurity Magazine
- Report Period
- 2025
- Scope
- Phishing emails and security incidents across Darktrace's global customer base, including regional and sector trends.
- Sample Size
- Not disclosed
- Key Statistics
- Darktrace detected more than 32 million high-confidence phishing emails in 2025.
- More than 8.2 million phishing emails targeted VIPs, representing more than 25% of observed phishing attempts.
- 70% of phishing emails passed DMARC authentication.
- 1.6 million phishing emails originated from newly created domains, and 1.2 million contained malicious QR codes.
- In Asia-Pacific and Japan, 84% of organizations said AI-powered threats were already affecting them; 42% reported formal policies for safe AI use.
- Recommendations
- Adopt real-time, intelligent, dynamic identity security that governs access to enterprise data and the actions permitted after access.
MITRE ATT&CK
People
Mark McClainIdentified as SailPoint CEO; commented on the need for real-time identity security to govern access by people and AI agents.Shane BarneyIdentified as CISO at Keeper Security; commented on attackers using stolen credentials, hijacked tokens, and abused permissions to access systems and move laterally.
Vendors
DarktraceDarktrace detected more than 32 million high-confidence phishing emails in 2025, revealing a sharp surge in automated, identity-driven attacks that increasingly bypass traditional defenses.Keeper Securitypermissions, then moving laterally under the cover of legitimacy,” commented Shane Barney, CISO at Keeper Security.SailPointinadequate, and prompted a shift towards identity as the critical element to enterprise security,” SailPoint CEO, Mark McClain, said.
Products
Countries
BrazilEducation was the most impacted sector at 18%, with Brazil, Mexico and Colombia reporting the highest volumes over the past three years.ColombiaEducation was the most impacted sector at 18%, with Brazil, Mexico and Colombia reporting the highest volumes over the past three years.MexicoEducation was the most impacted sector at 18%, with Brazil, Mexico and Colombia reporting the highest volumes over the past three years.