Email is still the most common attack vector for cyber threats, according to a new report from Barracuda.

The researchers found that one in four emails during February 2025 was either malicious or spam. HTML attachments were the most common file type used in phishing emails. 

“One of the most striking findings from the report is that 23% of HTML attachments are malicious, making them the most weaponized type of text file,” Barracuda says.

“This statistic underscores a significant shift in how attackers are operating. Rather than relying solely on malicious links, cybercriminals are embedding harmful content within attachments to evade detection by traditional security measures. In fact, more than three-quarters of all detected malicious files were HTML files.”

Attackers are also increasingly embedding malicious QR codes within attachments, allowing them to evade security filters.

“68% of malicious PDFs and 83% of malicious Microsoft 365 documents contain QR codes that lead to phishing or other harmful websites,” the researchers write. “These file types are widely trusted in business environments, making them effective in social engineering attacks. Once the QR code is scanned, victims are redirected to phishing pages impersonating Microsoft 365 login portals, where attackers steal credentials to compromise business accounts.”

Additionally, the researchers found that 20% of organizations experience at least one account takeover (ATO) attack each month.

“ATO attacks create long-term security risks by allowing attackers to conduct reconnaissance activities and spread further attacks,” Barracuda says. “27% of ATO incidents involved suspicious rule changes, such as setting up email forwarding to an external address or auto-deleting incoming security alerts. These tactics help attackers maintain persistence and avoid detection. Additionally, 17% of compromised accounts were used to send spam or harmful messages, often leading to further phishing attacks, malware distribution, or BEC scams.”

The researchers add, “To mitigate risks associated with ATO, SMBs should prioritize multi-factor authentication (MFA), employee security awareness training, and automated monitoring for suspicious account activity.”

KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.

Barracuda has the story.