Cofense Report Details AI-Driven Phishing Trends Observed in 2025

Summary

Cofense’s 2026 report describes 2025 phishing trends, including more malware delivery, adaptive and polymorphic campaigns, AI-assisted business email compromise, increased abuse of remote access tools, and growth in credential phishing using .es domains.

Key points

Cofense said its Phishing Defense Center observed an average of one malicious email every 19 seconds in 2025, and a 204% increase in phishing emails delivering malware compared with 2024.
Cofense found 76% of initial infection URLs were unique across its customer base, while 94% reused the same infrastructure; 82% of malicious files had unique hashes.
Phishing sites increasingly adapted content and payloads to visitors’ devices and browsers. Cofense also observed more Android app files delivered through phishing in 2025 than in the previous three years combined.
Conversational attacks, including business email compromise, accounted for 18% of malicious emails observed in 2025, according to Cofense.
Cofense reported a 57% increase in threat actors’ use of legitimate remote access tools, while its report’s top-line figures cite nearly 900% growth in legitimate remote access tool abuse by volume.
Credential phishing use of .es domains increased 51 times from 2024 to 2025, Cofense reported; the domains were commonly used for redirects or final phishing pages.
Other reported year-over-year changes included a 114% increase in ClickFix attacks and a sixfold increase in the use of legitimate files.

Article Details

Publisher: Cofense
Report Period: 2025
Scope: Phishing trends and activity observed by Cofense Intelligence and the Cofense Phishing Defense Center.
Sample Size: Not disclosed; the report describes analysis of phishing reports from millions of trained users.
Key Statistics: The Cofense Phishing Defense Center saw an average of one malicious email every 19 seconds throughout 2025.
Phishing emails delivering malware increased 204% compared with 2024.
In 2025, 76% of identified initial infection URLs were unique across customers, while 94% of the IP addresses associated with those URLs were seen multiple times.
Conversational attacks accounted for 18% of malicious emails identified in 2025.
Use of the .es TLD in credential phishing was 51 times higher in 2025 than in 2024.
Recommendations: Analyze phishing activity after delivery, using behavioral context and human validation rather than relying only on perimeter controls.
Limit publicly available personal and organizational information that attackers can use to personalize phishing.
Use AI-driven detection with human supervision and contextual signals to distinguish abused remote access tools from authorized software.
Align security and IT teams so alerts involving software used for legitimate administration are assessed in context.

Indicators of compromise

Type	Indicator	Context
HOSTNAME	`challenge[.]rocarlo[.]es`	Example of a compromised or attacker-controlled subdomain used in .es credential-phishing campaigns.
HOSTNAME	`post[.]bphsrpzyqg[.]es`	Example of a compromised or attacker-controlled subdomain used in .es credential-phishing campaigns.
HOSTNAME	`switch[.]bphsrpzyqg[.]es`	Example of a compromised or attacker-controlled subdomain used in .es credential-phishing campaigns.