Fast Facts
- Voice-based phishing attacks increased significantly in 2025, accounting for 11% of all incidents, marking a shift from traditional email phishing.
- Exploited vulnerabilities in software like SAP, Oracle, and Microsoft SharePoint remained the top initial access points, used in both targeted and zero-day exploits.
- Mandiant responded to over 500,000 hours of global incident investigations in 2025, with technology companies being the most targeted (17% of incidents).
- The decline in email phishing (down from 22% in 2022 to 6% in 2025) reflects attackers’ preference for more sophisticated social engineering tactics like impersonation calls, which are harder to defend against.
What’s the Problem?
In 2025, voice-based phishing, a social engineering tactic where attackers impersonate trusted figures via phone calls, surged significantly, comprising 11% of all cyber incidents reported by Mandiant. This method proved to be highly effective because it exploits human trust and requires specialized skills, making it more compelling than traditional email phishing, which saw a decline from previous years. Attackers targeted organizations’ IT help desks and employees, often successfully convincing them to grant access to sensitive networks. Notably, this shift was linked to attacks attributed to cybercrime groups like The Com and its offshoots, including Scattered Spider, who executed large-scale, impactful campaigns against various industries. Meanwhile, attackers continued to exploit technical vulnerabilities, such as flaws in SAP, Oracle, and Microsoft software, which accounted for 32% of incidents, indicating that both human and technical weaknesses remain critical security points.
The increase in voice phishing reflected a strategic change by cybercriminals, who favored this approach over traditional email tricks because it demands more effort but yields higher success rates. Mandiant, based on its investigations covering over half a million hours, reported that technology companies and financial institutions were among the most frequently targeted entities. The rise of voice phishing, combined with persistent exploitation of software vulnerabilities, underscores a troubling evolution in cyber threats. This shift highlights the importance for organizations to enhance both their technical defenses and employee awareness, as attackers continue to refine their tactics to bypass conventional security measures and capitalize on human vulnerabilities.
Critical Concerns
Certainly! Here’s a concise explanation:
The issue “The phone call is the new phishing email” can threaten your business’s security. Attackers now use fake calls to deceive employees into revealing sensitive information or giving access to systems. Unlike traditional emails, these calls often sound convincing and urgent, making it harder to detect the scam. As a result, your business can face data breaches, financial loss, and damage to reputation. Moreover, the trust between your staff and clients may fracture, creating long-term problems. Therefore, without proper awareness and strict protocols, any business risks falling victim to these sophisticated attacks.
Possible Next Steps
In today’s digital landscape, responding quickly to evolving attack methods like the phone call surging as the new phishing email is crucial. Timely remediation minimizes potential damage, strengthens defenses, and maintains organizational trust.
Detection & Identification:
- Train employees to recognize suspicious or unexpected calls.
- Implement call logging and monitoring tools to flag unusual activity.
Containment & Analysis:
- Verify identities before sharing sensitive information.
- Record and review suspicious calls for evidence and patterns.
Eradication & Recovery:
- Block or restrict further calls from malicious sources.
- Reset compromised communication credentials or systems.
Preventative Measures:
- Deploy caller authentication tools like caller ID verification.
- Develop and disseminate clear protocols for handling sensitive inquiries by phone.
- Conduct regular staff awareness training on social engineering tactics.
Continuous Improvement:
- Review incident responses to refine detection and mitigation strategies.
- Keep communication policies and employee training up to date with current threats.
Continue Your Cyber Journey
Explore career growth and education via Careers & Learning, or dive into Compliance essentials.
Learn more about global cybersecurity standards through the NIST Cybersecurity Framework.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1cyberattack-v1-multisource
