A cybersecurity firm’s nine-month incident data analysis shows rise in AI-powered phishing, Southeast Asia proxy attacks and multichannel scams this year.
Based on data analysis of more than 24 trillion data points collected from nearly 43,000 customers around the world for Jan – Sep 2025, a global cybersecurity firm has shared some cyber findings with the media.
First, data shows that compromised systems in developing technology hubs in South-east Asia have increasingly been used as proxy networks or stepping stones to launch cyberattacks globally. These compromised systems help mask the origin of attacks, complicating efforts to attribute or contain them.
Second, phishing attacks accounted for 77% of all attacks detected in the firm, up from 60% in 2024 data. This suggest attackers have increasingly leveraged AI tools to expand the volume and sophistication of phishing campaigns, including AI-powered email content and automated conversation chains.
Other findings
ClickFix attacks, where users are tricked into copying and running malicious commands via fake error messages or verification prompts, had increased by over 500% in the first six months of 2025. This accounted for nearly 8% of reported attacks, second only to reported phishing incidents in the data. The data also suggests:
- Business email compromise attacks have evolved with the use of automated conversation chains that create the illusion of legitimate communication between vendors and senior executives. These attacks primarily use wire transfers and invoice fraud as vectors and often shift communication channels from email to phone calls for greater effectiveness.
- Attackers increasingly “live off trusted services”, exploiting everyday business platforms to deliver malicious content. In the firm’s data, DocSend was the most abused service in 2025, overtaking others.
- Threat actors in the incidents analyzed frequently used legitimate and custom CAPTCHA services in their attack chains to hinder security analysis and detection, with more than 900,000 detections of such techniques by groups like Scattered Spider primarily in the US and UK.
- Multichannel attacks involving coordination across email, phone, and other communication forms were more common than ever. For example, phishing emails include phone numbers for victims to call, reducing detection visibility and increasing success rates. AI-generated voices and deepfake technology have been reported to amplify these tactics.
- Industry-specific threat profiles show professional education, IT software, telecommunications, real estate, and legal sectors faced higher volumes of impersonation and phishing attacks. The real estate sector notably experienced significantly more phishing attacks than other industries.
- Collaboration platforms such as Microsoft Teams, SharePoint, and OneDrive show mostly malware threats, with phishing and risky links also present. Threat actors in the data had exploited these persistent data repositories to gain intelligence for targeted social engineering.
According to Ranjan Singh, Chief Product / Technology Officer, Mimecast, the firm releasing its (Jan to Sep 2025) data findings: “Financial platforms, regulatory agencies, and city governments have all been targeted by profit-driven ransomware groups and highly organized, state-sponsored adversaries. Threat actors (have been) doubling down on human-focused attacks and exploiting trusted business services as their primary means of intrusion, making employee awareness and resilient systems more essential than ever.”
