The evolving landscape of email phishing attacks: how threat actors are reusing and refining established techniques

The Securelist piece dated 21 Oct 2025 examines how email phishing attacks are evolving, with threat actors reusing and refining established techniques while adding new twists. It highlights that PDFs are increasingly used in phishing, not only with links but also containing QR codes, and sometimes password‑protected attachments to thwart automated scanning.

The article notes a revival of calendar-based phishing in 2025, now deployed in B2B campaigns that target office workers by embedding phasing links in calendar events. It also describes advances in MFA evasion, including phishing sites that mimic legitimate services and even verification chains with CAPTCHA to delay bots and attackers.

A notable example shows a pCloud-themed attack where the domain differs (p-cloud[.]online) but relays data to the real service, with an OTP step that ultimately yields access to the victim’s account if credentials are entered. The piece concludes that attackers are making phishing pages more sophisticated and convincing, underscoring the need for vigilance, security training, and robust email security solutions.