Email Threat Statistics: Malicious Mail Volumes, Attachment Types and What Reaches Inboxes

Email security teams are asked how much malicious mail they face, which file types carry it and how much gets past the gateway, and most quoted answers trace back to no source at all. This page gathers email threat volume figures from the publishers that process the mail: Kaspersky's annual spam and phishing report, Barracuda's 2026 Email Threats Report, Hornetsecurity's annual Cybersecurity Report, Cofense's 2026 annual report, Microsoft's Tycoon 2FA analysis and the UK National Cyber Security Centre (NCSC). Every figure names its report, publisher, dataset and period in the same sentence or table row. Phishing as a breach vector, complaint counts and losses are covered in the Phishing Statistics Guide, and fraud losses in the Business Email Compromise and Fraud Statistics Guide; this page covers mail volumes, attachment and link types, and what reaches the inbox. It is for email security engineers tuning filters, SOC teams sizing triage and leaders justifying layered email controls. Last reviewed: November 2026.

Key takeaways

• A third to almost half of mail is unwanted. Kaspersky measured spam at 44.99% of global email traffic in 2025, and Barracuda found 33% of 3.1 billion messages in January 2026 were malicious or unwanted, up from one in four a year earlier.
• Malicious attachments are rising. Kaspersky blocked 144,722,674 malicious email attachments in 2025, about 19 million more than the year before, and Hornetsecurity reports malware-laden email up 131% for October 2024 to October 2025.
• HTML is the attachment to watch. Barracuda found 10.48% of HTML attachments malicious in January 2026, about two-thirds of all malicious files it saw; Hornetsecurity's 2024 data put HTML (20.4%), PDF (19.2%) and archives (17.6%) at the top.
• QR codes hide in documents. 70% of malicious PDFs and 56% of malicious Microsoft 365 documents in Barracuda's January 2026 data contained QR codes, moving the link off the scanned message and onto a phone.
• What reaches inboxes is unique and fast. Cofense's user-reported data shows a malicious email every 19 seconds in 2025 (one every 42 seconds in 2024), with 76% of infection URLs unique to one customer and 82% of malicious files carrying unique hashes.

Headline statistics

These publishers see different mail streams: consumer and business endpoints (Kaspersky), business gateways (Barracuda, Hornetsecurity) and mail users reported after delivery (Cofense). The figures are not interchangeable.

Malicious mail volumes

How much mail is unwanted

Kaspersky's 2025 average of 44.99% spam is a global traffic measure and fell 2.28 percentage points on 2024. Business gateway data runs lower but is rising: Barracuda's January 2026 sample found 33% malicious or unwanted, against one in four a year earlier, and Hornetsecurity found 36.9% of business mail unwanted in its November 2023 to October 2024 period, with 2.3% of that unwanted mail carrying malicious content. Hornetsecurity's later report, covering more than 72 billion emails from 15 October 2024 to 15 October 2025, measured malware-laden email up 131%, phishing up 21% and scams up 34.7%.

What the malicious share is made of

Barracuda breaks down malicious and unwanted activity for January 2026:

The low percentages for spear phishing, conversation hijacking and BEC reflect their volume, not their harm: they are the targeted, low-volume messages most likely to carry a payment request. Where spam is sent from matters for reputation filtering: Kaspersky attributes 32.50% of outgoing spam in 2025 to Russia, 19.10% to China and 10.57% to the United States.

Phishing-as-a-service drives volume

Barracuda reports that 90% of high-volume phishing campaigns used phishing-as-a-service kits, up from 30% in 2024, and that 48% of kits used MFA bypass, 48% URL obfuscation, 43% CAPTCHA abuse and 18% malicious attachments. Microsoft's March 2026 analysis of one kit, Tycoon 2FA, records more than 30 million emails in a single month in mid-2025 and about 62% of all phishing attempts Microsoft blocked by that point. Campaign subdomains typically lasted 24 to 72 hours, which is why reputation blocklists lag. Kit mechanics are in the AiTM Phishing Guide.

Attachment and file types

Attachment data answers which file types to block, sandbox or strip. Two measures appear in the sources: the share of each file type that is malicious (Barracuda) and the share of malicious attachments by type (Hornetsecurity).

HTML attachments are dangerous because they run in the browser: they can render a credential page locally or assemble a payload on the device, a technique tracked as T1027.006 HTML Smuggling. See the HTML Smuggling Guide. PDFs and Office files are rarely malicious by share, but when they are, Barracuda found most carried QR codes (70% of malicious PDFs, 56% of malicious Microsoft 365 documents). The defence for those is covered in the QR Code Phishing (Quishing) Guide.

Malware families in mail

Kaspersky's 2025 list of the families most often found in email attachments is led by Makoob (4.88%), Badun (4.13%), Taskun (3.68%), Agensla (3.16%), Trojan.Win32.AutoItScript (2.88%) and Noon (2.63%), with Hoax.HTML.Phish (1.98%) and Guloader (1.90%) also in the top ten. No single family exceeds 5%, which argues for behaviour-based detection over signature lists. Cofense's data points the same way: it saw a 204% rise in phishing emails delivering malware in 2025, almost 900% growth by volume in abuse of legitimate remote access tools, and more Android application packages (APK files) delivered in 2025 than in the previous three years combined. Remote access tool abuse is covered in the MITRE ATT&CK T1219 Remote Access Tools guide.

Where malicious attachments land

Kaspersky's 2025 country shares of malicious attachments blocked were led by China (13.74%), Russia (11.18%), Mexico (8.18%) and Spain (7.70%). These reflect where its users are as much as where attackers aim, so use them for trend, not exposure.

What reaches the inbox

No publisher in this set states a single gateway bypass rate, and any vendor figure on what "gets past" depends on which gateway and configuration was in front of it. The best available evidence comes from mail users reported after delivery:

• Frequency: Cofense's Phishing Defense Center recorded a malicious email every 19 seconds in 2025, against one every 42 seconds in 2024.
• Uniqueness: 76% of initial infection URLs were unique to a single customer and 82% of malicious files had unique hashes, which defeats shared blocklists and hash matching.
• Reused infrastructure: 94% of the IP addresses behind those unique URLs were seen multiple times, so infrastructure intelligence still works where URL intelligence does not.
• No payload at all: 18% of malicious emails were conversational, plain text with no URL or attachment, the second largest vector in Cofense's data. Content scanning has nothing to inspect, which is why BEC controls rely on sender authentication and payment process checks.
• Legitimate hosting: Cofense saw files hosted on Dropbox, Amazon S3 and OneDrive, often with valid digital signatures.

Hornetsecurity's earlier figure of 427.8 million malicious emails received by businesses (November 2023 to October 2024), which its chief executive described as still reaching inboxes, is the closest published volume, although the release does not say how many were blocked. Treat it as one vendor's customer base, not a market rate.

Account takeover and the internal mail problem

Mail sent from a compromised internal account passes sender authentication and most reputation checks. Barracuda's January 2026 data found 34% of companies had at least one account takeover incident each month, 25% of those incidents involved suspicious inbox rule changes and 14% of compromised accounts were used to send spam or harmful content. Inbox rule auditing is the practical response; see How to Audit Mailbox Forwarding and Inbox Rules. This is the identity angle of email security: a mailbox is an account, and its session and MFA posture decide whether it becomes a sender of trusted malicious mail. See the Email Identity and BEC Guide.

Framework mapping

CIS Controls v8.1 Control 9 (Email and Web Browser Protections) is the closest control family; see the CIS Control 9 Email and Web Browser Protections Guide.

What the numbers mean for defenders

1. Strip or sandbox HTML first: it is the most malicious attachment type by share in Barracuda's data and the largest by volume in Hornetsecurity's. Start in quarantine-and-notify mode for external senders, measure business impact for two weeks, then block.
2. Inspect what is inside documents: extract QR codes and embedded links from PDFs and Office files and send them through the same URL analysis as message links.
3. Add time-of-click and post-delivery controls: with 76% of URLs unique and subdomains living 24 to 72 hours, delivery-time verdicts go stale. Microsoft's recommended set includes Safe Links (time-of-click URL checks), Safe Attachments and Zero-hour auto purge; other platforms offer equivalents.
4. Make reporting easy and fast: user reports are the only source of the "what got through" data above. Route reports to triage and feed verdicts back to the gateway. UK users can forward scams to [email protected]; the NCSC had removed 454.8k scam URLs as of July 2026.
5. Treat no-payload mail as a process problem: for the 18% of conversational attacks, enforce DMARC and out-of-band payment verification. See the DMARC, SPF and DKIM Guide.

Metrics to track against these benchmarks

• Delivered malicious rate: confirmed malicious messages found post-delivery per 10,000 delivered, by type (link, attachment, no payload).
• Zero-hour removal time: median minutes from first delivery to removal of a campaign from all mailboxes.
• HTML and archive exposure: number of external HTML and password-protected archive attachments delivered per week, target zero after enforcement.
• Report-to-verdict time: median time from user report to triage verdict.
• Inbox rule alerts: suspicious forwarding or deletion rules created per month and time to remediate.

Methodology notes and caveats

• Different streams: Kaspersky measures detections on its users' devices and mail servers; Barracuda and Hornetsecurity measure business gateway traffic; Cofense measures mail users reported after delivery.
• Different periods: Barracuda's figures are one month (January 2026); Hornetsecurity runs mid-October to mid-October; Kaspersky and Cofense use calendar years.
• Inconsistent internal figures: Barracuda's archive share appears as 0.31% in a chart and 0.13% in its text; quote the range or the chart value with that caveat.
• Vendor data: every volume figure here comes from a vendor's own customer base, so growth rates partly reflect customer growth and product changes.

Common failure patterns

• Quoting a "bypass rate" with no denominator: without the gateway, configuration and delivered volume, the number cannot be compared to your environment.
• Allowing HTML attachments for convenience: the file type most often malicious is still delivered by default in many tenants.
• Scanning the message but not the document: QR codes inside PDFs and Office files move the link where the gateway does not look.
• Relying on hash and URL blocklists: 82% unique file hashes and 76% unique URLs mean shared indicators arrive after the campaign.
• Trusting internal senders: compromised mailboxes send trusted malicious mail, and 34% of companies in Barracuda's data saw account takeover monthly.

Practitioner checklist

• Quote email statistics with publisher, dataset size and period, and say which mail stream it measures.
• Block or sandbox external HTML attachments and quarantine archives the gateway cannot open.
• Extract and analyse links and QR codes inside PDF and Office attachments.
• Enable time-of-click URL protection and post-delivery removal.
• Measure delivered malicious mail per 10,000 messages from user reports and hunts.
• Audit mailbox forwarding and inbox rules monthly and alert on new external forwarding.
• Enforce DMARC and out-of-band payment verification for no-payload attacks.
• Refresh these figures when Kaspersky (February), Barracuda, Hornetsecurity (November) and Cofense publish new editions.

Standards and references

• NCSC: Reporting a scam email
• Kaspersky Securelist: Spam and phishing in 2025
• Barracuda: 2026 Email Threats Report
• Hornetsecurity: Cybersecurity Report press release, November 2025
• Hornetsecurity: Cybersecurity Report press release, December 2024
• Cofense: Annual Report 2026
• Microsoft Security: Inside Tycoon2FA, how a leading AiTM phishing kit operated at scale
• Microsoft: How a global coalition disrupted Tycoon 2FA

Related NHI Mgmt Group resources: Phishing Statistics Guide · Email Security Guide · Malware Statistics · Business Email Compromise and Fraud Statistics Guide