A new report from Menlo Security (PDF) shows a 140 percent increase in browser-based phishing attacks over the past year, as well as a 130 percent increase in zero-hour phishing attacks (i.e., novel attacks that are undetectable to existing detection tools).
There are several reasons for this explosive growth: our reliance on the browser in the workplace, zero-day vulnerabilities, advanced phishing tools, and increasing adoption of generative AI.
Criminals are now using AI to create credible phishing websites, trick users with fake AI services, and automate targeted attacks. According to security strategist Andrew Harding, advanced social engineering is being combined with “Phishing-as-a-Service” kits and zero-day vulnerabilities. All signs point to this trend accelerating in 2025.
The report also shows that fake AI sites don’t just steal login credentials. Many of them trick users into downloading infected PDFs, for example as part of fake résumé generation tools. On mobile devices, the risk is even greater as small screens and auto-logins hide red flags.
“In 2025, AI-driven cyber fraud will rise, making it harder to distinguish between legitimate and malicious sites…
…Scam activities such as fake AI tools used to offer premium AI services will be used to steal login credentials and personal data, or redirect users to phishing forms. Exploitation of user trust through sophisticated social engineering techniques will be key to targeting social media platforms and search engines.”
It’s never been more important than now to learn how to recognize the most common types of phishing scams. Be on the lookout for suspicious yet seemingly legit emails—especially ones from well-known companies like PayPal—and triple-check before clicking links or downloading files. Always check the authenticity of a website before logging in with your credentials or disclosing sensitive personal information.