Phishing moves out of email and into off-the-shelf attack kits

Push Security has published its review of phishing trends for 2025. A third of the phishing the company detected did not arrive by email, and most attacks are now attacker-in-the-middle, with the attacker positioned between the user and the login page. The attacks are largely driven by criminal Phishing-as-a-Service kits, ready-made tooling sold as a subscription.

What this means for your organisation

Security awareness training in most Norwegian organisations still centres on email. When a third of attempts arrive through other channels, the training misses. Push Security also notes that attackers are working around phishing-resistant authentication using techniques such as ConsentFix and ClickFix, where the user is tricked into granting a consent or running a command. MFA is no longer an end point in the risk assessment.

Berigo recommends

• Extend phishing training to the channels people actually use: chat, collaboration tools, SMS and social media.
• Review which third-party apps users can consent to in your identity platform, and require admin approval for new ones.
• Log and follow up OAuth consents and unusual sign-ins, not just failed password attempts.
• Exercise your response to a session hijacked after valid MFA, not only to stolen passwords.

Source

• pushsecurity.com