According to Kaspersky telemetry, almost every second email – 44.99% of global traffic – was spam in 2025. Spam consists not only of unsolicited emails, but can also include various email threats such as scam, phishing and malware.

In 2025, individuals and corporate users encountered over 144 million malicious and potentially unwanted email attachments, representing a 15% increase compared to the previous year figures.

In 2025, APAC had the largest share of email antivirus detections: it reached 30%, followed by Europe with 21%. Next came Latin America (16%) and the Middle East (15%), Russia and CIS (12%) and Africa (6%). As for individual countries, China had the highest rate of malicious and potentially unwanted email attachments, with the share of email antivirus detections of 14%. Russia ranked second (11%), followed by Mexico (8%), Spain (8%) and Turkey (5%).

Email antivirus detections peaked moderately in June, July and November.

Key trends in email spam and phishing

Kaspersky’s annual analysis has also identified several persistent trends in the email spam and phishing threat landscape that are expected to continue into 2026:

• Combination of various communication channels. Attackers lure email users into switching to messengers or calling fraudulent phone numbers. For instance, scam investment mailings may redirect victims to fake websites, where they are asked to provide their contact information, and then cybercriminals will follow up with a phone call.
• Usage of diverse evasion techniques in phishing and malicious emails. Threat actors frequently try to disguise phishing URLs, for example, with the help of link protection services and QR codes. These QR codes are often embedded directly in email bodies or within PDF attachments, which not only conceals phishing links but also encourages users to scan them on mobile devices, potentially exploiting weaker security measures than corporate PCs.
• Mailings exploiting diverse legitimate platforms. For example, Kaspersky experts discovered a fraudulent tactic that abuses OpenAI’s organisation creation and team invitation features to send spam emails from legitimate OpenAI addresses, potentially tricking users into clicking scam links or dialing fraudulent phone numbers. Additionally, a calendar-based phishing scheme, which originated in the late 2010s, resurfaced last year with a focus on corporate users.
• Refining tactics in business email compromise (BEC) attacks. In 2025 attackers attempted to become even more persuasive by incorporating fake forwarded emails into their correspondence. These emails lacked thread-index headers or other headers, making it difficult to verify their legitimacy within an email conversation. 

“Email phishing shouldn’t be underestimated. Our report reveals that one in ten business attacks starts with phishing, with a significant proportion being Advanced Persistent Threats (APTs). In 2025, we saw an increase in the sophistication of targeted email attacks. Even the smallest details are meticulously crafted in these malicious campaigns, including the composition of sender addresses and the tailoring of content to real corporate events and processes.

“The commodification of generative AI has significantly amplified this threat, enabling attackers to craft convincing, personalised phishing messages at scale with minimal effort, automatically adapting tone, language and context to specific targets,” comments Roman Dedenok, anti-spam expert at Kaspersky.

The Cybersafe Foundation has collaborated with Google in strengthening cybersecurity resilience among Critical Community Institutions across Nigeria, Kenya, Ghana and South Africa with the launch of Resilio Africa.

Speaking at the event in Lagos, Confidence Staveley, Executive Director of the Cybersafe Foundation, noted that while many organizations recognize the risks posed by cyber threats, conversations often stall when it comes to implementation.

“Across Africa, Critical Community Institutions are facing an increase in cyberattacks often without the capacity to defend themselves. Sub-Saharan Africa is now experiencing some of the most aggressive cyber activity globally. According to a threat report by Kaspersky, the region recorded over 42 million web attacks and 95 million malware-based, on-device attacks in just the first half of 2025.

“What’s especially concerning is the nature of these attacks: spyware, password stealers, and backdoor tools dominate, with password-stealing malware increasing by more than 60%.

“In East Africa, the scale is even more stark. Kenya alone recorded 2.5 billion cyber-threat events in Q1 2025, driven largely by phishing, mobile money fraud, and misconfigured cloud services,” she stated.

According to her, the primary barrier is not a lack of willingness but limited financial capacity to fund adequate cybersecurity measures.

“The conversation drops off at the point of taking action,” she said, explaining that many institutions lack the budgets required to implement robust security systems.

She disclosed that the programme’s provision of 10,000 hours of expert cybersecurity consultation—offered at no cost to participating institutions would ordinarily represent services valued at over one million dollars. The support, funded through a grant from Google.org, will be delivered by specialists across four participating countries.

Staveley reaffirmed that the Cybersafe Foundation remains a non-profit organization focused on supporting vulnerable communities and institutions, and described Resilio Africa as a strategic intervention aimed at strengthening digital trust across the continent, ensuring that commerce and essential public services can operate securely in an increasingly digital society.

Although the programme currently covers Nigeria, Kenya, Ghana and South Africa, Staveley acknowledged that the cybersecurity challenges extend far beyond those countries, and expressed hope that demonstrated impact from the initial phase would attract additional funding to scale the initiative to more than the 200 critical community institutions currently targeted, including underserved Francophone nations.

“This work is free to the organizations we serve, but it is not free to deliver,” she noted, underscoring the need for sustainable funding.

Explaining her personal motivation, Staveley said she views Africa’s cybersecurity challenges as opportunities for impact. Despite her engagements on global platforms, she emphasized her commitment to Nigeria and the broader African continent, describing the region as both home and a priority.

She pointed to a growing mismatch between rising cyber threats and limited investment in cybersecurity infrastructure, arguing that bridging this gap is central to the Foundation’s mission.

Staveley also clarified that Resilio Africa will not collect or own user data from participating institutions. Instead, the programme will focus on strengthening internal controls, building capacity and guiding organizations toward improved data protection practices.

With Resilio Africa now underway, the Cybersafe Foundation aims to demonstrate how targeted support for critical community institutions can enhance digital security and build long-term resilience across Africa’s rapidly expanding digital economy.

Kaspersky has announced a major update to its Threat Intelligence Portal (TIP), introducing a new Hunt Hub section alongside an enhanced MITRE ATT&CK coverage map and a significantly expanded vulnerabilities database.

The update strengthens organisations’ ability to investigate threats, understand adversary behaviour, and proactively monitor the most relevant risks across their environments.

According to the Kaspersky Security Bulletin 2025 report, Kaspersky’s detection systems discovered an average of 500,000 malicious files per day in 2025, marking a 7% increase compared to the previous year. As cyberattacks become more sophisticated and frequent, security teams need more than alerts – they need clarity.

The newly launched Hunt Hub is designed to address growing market demand for greater transparency and deeper insight into how modern detection technologies work. Integrated into the Threat Landscape section of the Threat Intelligence Portal, Hunt Hub provides centralised access to Kaspersky’s threat hunting expertise and detection knowledge.

Hunt Hub includes Kaspersky Next EDR Expert hunts, also known as indicators of attack (IoA) or detection rules. All portal users can explore the catalogue of hunts and their descriptions, while Kaspersky Next EDR Expert customers gain extended access to detailed recommendations and detection logic presented in a convenient, SIGMA-like format. Each hunt is mapped to relevant MITRE ATT&CK tactics and techniques and linked to known threat actors, giving analysts clear context behind every detection.

By making detection logic visible and structured, Hunt Hub effectively removes the “black box” from threat detection. It allows security teams not only to respond to alerts, but also to understand why a detection was triggered and which threat it is designed to uncover – improving trust in security technologies and increasing the efficiency of threat investigation processes.

As part of the update, the MITRE ATT&CK coverage map within the Threat Landscape has been significantly enhanced. The portal now brings together product coverage across SIEM, EDR, NDR and Sandbox solutions, MITRE ATT&CK techniques with scoring, coverage percentages, and related Kaspersky Next EDR Expert hunts in a single, unified view. This enables organisations to assess how well their security stack covers relevant attack techniques and identify potential gaps in protection.

The Vulnerabilities section has also been expanded, with the CVE database now covering nearly 300,000 vulnerabilities. In addition, the portal provides more detailed information on vulnerabilities that have been exploited in real-world attacks, helping organisations prioritise remediation efforts based on actual threat activity.

“With the launch of Hunt Hub in the Kaspersky Threat Intelligence Portal, we are opening up our detection expertise and giving analysts clear visibility into how and why threats are detected. This transparency helps organisations move from reactive alert handling to informed threat hunting and proactive risk management,” comments Nikita Nazarov, Head of Threat Exploration at Kaspersky.