IR Trends Q2 2025: Phishing attacks persist as actors leverage compromised valid accounts to enhance legitimacy
Summary: Phishing was the top initial access method in Cisco Talos IR's Q2 2025 engagements at one-third of cases, down from 50 percent the prior quarter, with 75 percent of those phishing engagements using compromised internal or trusted business partner email accounts. Ransomware and pre-ransomware made up half of all engagements, Talos responded to Qilin ransomware for the first time, and actors used the dated PowerShell 1.0 in a third of ransomware and pre-ransomware engagements.
Key Takeaway: Attackers sending phishing from a real partner's mailbox bypass the trust controls your users and filters rely on, and in one engagement a single harvested credential led roughly a dozen more users to hand over theirs. Qilin's data leak site disclosures have doubled since February 2025, and Talos assesses the group may be expanding its affiliates or increasing operational tempo.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026