The Anti-Phishing Working Group (APWG), in conjunction with Fortra and other industry research members, has released their quarterly Phishing Activity Trends Report to analyze the most recent phishing attacks, threats, and trends.
2025 Q1 Phishing Activity Trends Summary:
In the first quarter of 2025, APWG observed a total of 1,003,924 phishing attacks, which was the largest attack volume since late 2023.
Criminals send millions of emails each day containing QR codes that lead consumers to phishing sites and malware.
Attacks against the online payment and financial (banking) sectors grew in Q1 2025, together totaling 30.9 percent of all attacks.
The total number of wire transfer BEC attacks observed in Q1 2025 increased by 33% compared to the previous quarter.
Most Targeted Industries of Q1 2025
The SaaS/Webmail sector was the most targeted industry by cyber attackers in Q1 2025, making up almost 18% of the total attack volume. The financial industry also continues to be a highly attractive sector for cyber threat attackers, with Payment, Banking, and Crypto contributing to approximately 33% of all phishing attacks in Q1 2025.
QR Code Attacks Across Multiple Sectors
QR code attacks occur when an adversary leverages QR codes to social engineer a user, such as redirecting a victim to a phishing website or to download a malicious attachment. QR codes are becoming an increasingly popular phishing tactic due to the various features they offer. Cyber attackers have been observed taking advantage of QR code features in the following ways:
The availability of free QR code generators facilitates phishing attacks due to decreased financial costs of infrastructure, and free services tend to have less resources dedicated to takedowns of legitimate service abuse and other malicious activity.
Attackers can combine QR codes with URL shorteners to obscure the true destination of the URL and thereby direct victims to malicious sites.
APWG’s analysis revealed that “No single industry stood out as particularly vulnerable during this time period—criminals attacked multiple sectors relatively evenly”. However, it is worth nothing that certain industries tend to be more prone to QR code attacks, such as Retail & Wholesale, as consumers have adapted to relying on QR codes to access these services.
Business Email Compromise
APWG member Fortra tracks the identity theft technique known as “business e-mail compromise” or BEC, which was responsible for $2.8 billion dollars in losses in 2024 according to the IC3. In a BEC attack, a threat actor impersonates an employee, vendor, or other trusted party in an email communication and attempts to trick an employee into sending money, privileged information, or some other asset.
Fortra examined thousands of BEC attacks attempted during Q1 2025, and Fortra’s John Wilson, Senior Fellow Threat Researcher, noted that “The average amount requested in wire transfer BEC attacks in Q1 2025 was $42,236, a 67% decrease from the prior quarter’s average of $128,980.” Additional BEC trends identified by Fortra include:
During the first quarter of 2025, gift card scams were once again the most popular scam type, making up 51% of the total attack volume.
The total number of wire transfer BEC attacks observed by Fortra in Q1 2025 increased by 33 percent compared to the previous quarter.
72% of BEC attacks in Q1 2025 were launched using a free webmail domain.
When it comes to malware, Remcos RAT was the most common payload Fortra observed in Q1 2025.
Need More Intelligence? Explore Our Monthly BEC Global Insights Report
While APWG produces this report on a quarterly basis, Fortra publishes a monthly research report that provides threat intelligence trends and data on various topics such as business email compromise (BEC), phishing, global attack locations, and other social engineering methods. In fact, Fortra’s latest BEC Global Insights Report revealed that BEC attacks increased by almost 40% in volume compared to the previous month, credential phishing was the most common cash-out method as of this writing, and the United States was the most targeted location by BEC attackers. These trends are all part of our recurring monthly report that delivers timely insights into the latest emerging BEC and cybersecurity trends and shifts impacting the threat landscape.
How Fortra Can Help
Fortra’s extensive suite of advanced cybersecurity solutions can fortify your defenses against these phishing threats through:
Fortra Brand Protection: Safeguard your organization’s critical digital assets and infrastructure from various phishing threats such as social media attacks, data leakage, account takeover, and email scams. Our brand protection capabilities offer threat intelligence curated to your organization’s specific needs while mitigating these threats across multiple digital channels.
Fortra Email Security: Fortra tackles email phishing attacks including but not limited to suspicious email analysis that mitigates malicious emails in real time, human risk management to reduce end-user cyber risk through our expert curated training and phishing simulations, and cloud email protection that combines the powerful capabilities of machine learning and automation with advanced threat protection and intelligence.
Fortra Data Loss Prevention (DLP): Protect your sensitive data from these phishing threats by leveraging the power and versatility of Fortra’s DLP solution, including data discovery and classification, endpoint and cloud protection, and even analytics and reporting that provide crucial threat insights and trends.
Cybercrime Intelligence Shouldn't Be Siloed
Fortra® experts are dedicated to protecting organizations and the public by delivering the latest insights, data, and defenses to strengthen security against emerging cyber threats.