Topic starter
02/08/2026 11:54 am
TL;DR: Vishing attacks rose 449%, phishing sent from legitimate platforms increased 70%, and attacks bypassing secure email gateways climbed 38%, according to KnowBe4’s 2025 Phishing Threat Trends Report, Vol. 6, highlighting how social engineering now blends voice, brand abuse, and trusted delivery paths. That combination weakens traditional email-only defences and raises the value of identity-aware controls.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “2025 Phishing Threat Trends Report, Vol. 6”.
By the numbers:
- Vishing attacks increased by 449% in 2025, according to KnowBe4's report.
- Attacks sent from legitimate platforms increased by 70%, according to KnowBe4's report.
- Attacks bypassing secure email gateways increased by 38%, according to KnowBe4's report.
Key questions
Q: What breaks when phishing moves from email into voice and approved platforms?
A: Traditional inbox controls break down because they only inspect one delivery path.
Q: Why do vishing campaigns so often lead to account takeover?
A: Vishing works because it manipulates the human who is allowed to approve resets, confirm identities or authorise support actions.
Q: Why do legitimate-platform phishing campaigns bypass traditional controls so often?
A: They bypass traditional controls because many defences assume malicious delivery comes from suspicious infrastructure.
Practitioner guidance
- Strengthen help desk verification Require step-up verification for password resets, MFA resets and account recovery requests that arrive by phone or chat, especially when the request changes authentication state.
- Review trusted-platform sender assumptions Inventory SaaS and collaboration services that can deliver user-facing messages and remove implicit trust from any platform that can be abused for phishing or approval abuse.
- Add identity-aware checks to sensitive workflows Use transaction-specific verification for connected-app approvals, payment changes and privileged access requests so that a valid delivery channel does not equal valid authorisation.
Bottom line: Phishing is increasingly a trust and identity problem that reaches users through voice, branded platforms and legitimate workflows rather than only through email.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:02 pm
Phishing has become a trust orchestration problem, not an email problem. The important shift in this report is that delivery is no longer the main boundary. Attackers can reach the user through voice, trusted platforms or approved workflows, which means the control point has moved to how requests are verified before action is taken. For practitioners, that makes identity assurance at the moment of decision the real control surface.
A few things that frame the scale:
- Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.
A question worth separating out:
Q: Should security teams prioritise identity verification or email filtering against modern phishing?
A: Identity verification should take priority for high-risk actions because the attacker can route around email controls through voice, messaging or trusted platforms. Email filtering still matters, but it no longer covers the full decision path that leads to access, approvals or recovery.
👉 Read our full editorial: Phishing threat trends show vishing and platform abuse rising fast