Hornetsecurity 2026 Report Finds Malware Emails Rose 131% in 2025
Report discovered via Awesome Annual Security Reports.
Summary
Hornetsecurity’s 2026 report draws on over 72 billion processed emails, finding malware emails rose 131% in 2025. It also reports increased ransomware victimization and warns of AI governance gaps and identity threats.
Key points
- Hornetsecurity analyzed over 72 billion processed emails; its year-over-year email comparisons adjust for changes in sample size.
- Malware-classified emails increased 130.92%, scams rose 34.70%, and phishing grew 20.97% compared with 2024.
- Malicious TXT attachments increased 181.39% and legacy DOC attachments rose 118.25%; ICS and SHTML entered the report’s top-ten file-type list.
- The report identifies forged headers, legitimate hosting abuse, URL obfuscation, and HTML/MIME manipulation as prominent email-filter evasion techniques.
- Among organizations surveyed, 24% reported ransomware victimization, up from 18.6% in 2024; 13% of victims paid a ransom, down from 16.3%.
- CISO polling highlights sensitive-data leakage through public AI tools, weak employee awareness, and governance lagging behind AI adoption.
- For 2026, the report forecasts growing agentic AI misuse and identity threats, recommending phishing-resistant MFA, stronger account-recovery verification, integration monitoring, and tested recovery plans.
Article Details
- Publisher
- Hornetsecurity
- Report Period
- 2025
- Scope
- Email threats, Microsoft 365 security, ransomware survey findings, CISO perspectives on AI, and selected major cybersecurity incidents.
- Sample Size
- Over 72 billion emails analyzed; ransomware survey and CISO poll sample sizes not disclosed.
- Key Statistics
- Malware-classified emails increased by an adjusted 130.92% in 2025 versus 2024; calculations account for changes in sample size.
- Scam and phishing email classifications increased by an adjusted 34.70% and 20.97%, respectively, in 2025 versus 2024.
- Malicious TXT and DOC attachments increased by an adjusted 181.39% and 118.25%, respectively, in 2025 versus 2024.
- In the ransomware survey, 24% of organizations reported being victims in 2025, compared with 18.6% in 2024.
- Among ransomware victims, 13% paid a ransom in 2025, down from 16.3% in 2024.
- Recommendations
- Mandate phishing-resistant MFA as the only permitted sign-in method and strengthen enrollment and account-recovery verification, including in-person validation for privileged accounts.
- Maintain immutable backups and tested recovery plans for both on-premises and cloud data.
- Prioritize patching exploitable vulnerabilities in business-critical systems and monitor network devices for configuration changes.
- Monitor non-human identities and SaaS integrations for anomalous activity; revoke compromised OAuth tokens and integrations and reset additional exposed credentials.
- Inventory browser extensions, block malicious extensions, and provide scenario-based security awareness training.
MITRE ATT&CK
T1056.003 · Web Portal CaptureFake sign-in pages mimic legitimate identity providers to capture users' credentials.T1190 · Exploit Public-Facing ApplicationReported attacks exploited internet-facing VPN appliances, SharePoint servers, and an exposed F5 system to gain access.T1199 · Trusted RelationshipCompromised vendor platforms and integrations provided access to customer environments, including the Treasury breach through BeyondTrust and the Salesloft+Drift incident.T1498 · Network Denial of ServiceBlackMeta launched distributed denial-of-service attacks against Internet Archive websites, temporarily taking them offline.T1539 · Steal Web Session CookieThe report describes phishing kits stealing authentication tokens after users complete sign-in and MFA.T1550.001 · Application Access TokenAttackers obtained OAuth tokens from Salesloft's AWS environment to access Drift customers' environments.T1557 · Adversary-in-the-MiddleAttacker-in-the-middle phishing kits proxy credentials and MFA prompts to legitimate sign-in services while intercepting the resulting authentication token.T1566.001 · Spearphishing AttachmentThe report describes malicious email attachments, including DOC files, archives, text files, and calendar invitations, used to deliver phishing content or payloads.T1566.002 · Spearphishing LinkAttackers send phishing emails containing links to fake sign-in pages that capture credentials and authentication tokens.
People
Threat Actors
ARMORY CASTLEChina-linked espionage group to which the report attributes BRICKSTORM, the backdoor used during the F5 intrusion.BlackMetaHacktivist group reported to have launched DDoS attacks against Internet Archive websites in October 2024.Linen TyphoonOne of the Chinese state-sponsored groups to which Microsoft attributed exploitation of the SharePoint ToolShell vulnerabilities.SafepayRansomware group identified by cybersecurity journalists as responsible for the July 2025 Ingram Micro attack.Scattered SpiderDescribed as a loose affiliation of actors using helpdesk social engineering. Linked to retail and insurance attacks; investigators said the Qantas breach bore the hallmarks of its tactics.Storm-2603One of the Chinese state-sponsored groups to which Microsoft attributed exploitation of the SharePoint ToolShell vulnerabilities.UNC3886China-nexus APT group reported to have exploited a Junos OS zero-day and installed custom backdoors on routers.Violet TyphoonOne of the Chinese state-sponsored groups to which Microsoft attributed exploitation of the SharePoint ToolShell vulnerabilities.
Malware
Vendors
BeyondTrust| handled a similar attack, and how to improve | | | | | | on December 8, 2024, soon after BeyondTrust | | | | |F5 NetworksIn late August 2025 it became evident that On Monday the 1st of September 2025 Jaguar In October 2025, F5 Networks (a major vendor of without adequate monitoring and logging canHornetsecurityABOUT HORNETSECURITYIvantiEXPLOITS (IVANTI & SONICWALL)Juniper NetworksMARCH 2025 – JUNIPER NETWORKSMicrosoftprojections for the future of Microsoft 365 security threats, enabling businesses to act accordingly.SalesloftAUGUST 2025 – SALESLOFT+DRIFT SEPTEMBER 2025 - JAGUAR LAND ROVER echoes the SolarWinds breach back in 2020:SonicWallEXPLOITS (IVANTI & SONICWALL)
Products
BIG-IPis exactly what we highlighted in last year’s re- had to foot the entire bill for this disaster. proprietary BIG-IP source code and internal re-Entra IDin Entra ID) that verifies each login and tive in finding cracks in our systems to exploit.Junos OSJunos OS, the operating system for Juniper stronger cyber defenses in distribution and for resetting credentials (“I’ve lost my phone”), more details about this attack here. The attacksM365 CopilotM365 Copilot (Aim Labs) really show the seri- gence of LLM-driven orchestration, where large Windows Hello for Business, Certificate based processes. How do you validate that new hiresMicrosoft 365 Apps for Enterpriseprojections for the future of Microsoft 365 security threats, enabling businesses to act accordingly.SalesforceSalesloft, an integration for Salesforce (and Land Rover (JLR) production ground to a halt application delivery controllers and network se- remain undetected for a very long time. ThisSalesloft DriftAUGUST 2025 – SALESLOFT+DRIFT SEPTEMBER 2025 - JAGUAR LAND ROVER echoes the SolarWinds breach back in 2020:Secure Mobile Accessa zero-day in its Secure Mobile Access (SMA)SharePoint Serversvealed an ongoing espionage campaign target- stated that the incident would cause ongoing ed incidents. soft SharePoint Servers, collectively dubbed
Tools
Countries
Australiaan easy access point for attackers into your Natural Foods, Inc. (UNFI), a leading food distri- tas Airways, Australia’s flag carrier, announced and leading to increased pressure to pay, whichBrazilSlack / Pardot) had been compromised, and across their UK, Slovakia, Brazil and Indian fac- curity gear) disclosed that it had been breached is a developing story and while we don’t haveCanadaproduct shortages and delivery delays. The dis- the same time, WestJet (Canada) and Hawaiian ongoing wave of cyberattacks exploiting newChina| shortage of examples since our late 2024 re- | | | | | | coming on the heels of other China-linked at- | | | | |SlovakiaSlack / Pardot) had been compromised, and across their UK, Slovakia, Brazil and Indian fac- curity gear) disclosed that it had been breached is a developing story and while we don’t haveUnited KingdomSlack / Pardot) had been compromised, and across their UK, Slovakia, Brazil and Indian fac- curity gear) disclosed that it had been breached is a developing story and while we don’t haveUnited States| tool, looking at how your business would have | | | | | | notified | U.S. cybersecurity | | authorities | (CISA) |
Industries
Aviationed and maintained that they instead serve as In June 2025, a ransomware attack on United turned its attention to the aviation sector. Qan- more than a week) will severely impact others,Governmentsecurity and government cyber defenses.Insurance| | | Insurance, however, tells a different story. | | Insights Poll set out to capture how real-world | |IT distributionThis incident is something you can take directly of the world’s largest IT distribution companies, Microsoft released patches for the SharePointManufacturingrouters. Starting in mid-2024, the attackers manufacturing sectors, as even brief outages especially for high privilege accounts. All the allowed unauthorized access and code execu-Retail(AIRLINES AND RETAIL – QANTAS BREACH)