Phishing Trends Persist in Q2 2025: Cybercriminals Exploit Compromised Accounts for Credential Harvesting

Overview of Current Threat Landscape

In the second quarter of 2025, phishing has asserted itself as a continued prevalent method for initial access, accounting for one third of all engagements. This represents a decrease from 50 percent in the previous quarter, yet it continues to showcase the evolving tactics utilized by cybercriminals. A significant trend is the increasing reliance on compromised internal or trusted business partner email accounts to execute these attacks, allowing attackers to send seemingly legitimate emails and increasing their chances of bypassing established security controls.

The goals of these attacks predominantly center around credential harvesting, indicating that threat actors are transitioning towards the brokering of compromised credentials for profit rather than direct exploits like financial fraud or data theft. This shift emphasizes a concerning change in modus operandi among cybercriminals, leading to heightened risks for organizations reliant on strong security measures.

Phishing Attacks Using Compromised Email Accounts

During this reporting period, phishing was utilized in 75 percent of engagements that involved initial access through compromised email accounts. The credibility afforded by using legitimate accounts significantly enhances the effectiveness of these phishing attempts. For example, one phishing campaign involved emails sent from a legitimate business partner's compromised account, directing recipients to a fraudulent Microsoft O365 login page that required users to authenticate with Multi-Factor Authentication (MFA). This tactic not only aimed to capture users' credentials but also session tokens, thereby escalating the attacker's foothold within the organization.

This evolution of phishing techniques suggests a potential strategic shift among cybercriminals. Rather than attempting direct financial manipulation, many are finding that acquiring credentials through trusted communication channels is more efficient. The elimination of direct monetary requests from phishing emails often results in lower suspicion among potential victims, consequently increasing the likelihood of successful attacks. A reported situation highlights how an attacker compromised an email account when the user followed a link in a phishing email and disclosed their credentials. Following this, multiple internal spear phishing emails were dispatched, further propagating the attack and resulting in a cascade of credential theft.

Ransomware Activity: Insights and Tactics

Ransomware, along with pre-ransomware incidents, accounted for half of all engagements this quarter, paralleling trends established in the previous quarter. Notably, Cisco Talos Incident Response (Talos IR) faced Qilin ransomware for the first time, uncovering a series of novel tools and techniques previously undocumented. Including a new method for data exfiltration that raises a red flag for organizations to monitor closely.

Emergence of Qilin Ransomware

The incident response to Qilin ransomware revealed several previously unreported TTPs (Tactics, Techniques, and Procedures). Operators appeared to utilize a custom encryptor that includes hardcoded credentials for victim accounts, as well as leverage Backblaze for command and control services. This engagement marked a pivotal moment, indicating either a surge in operational tempo or a potential expansion of the group's affiliate network. Coupled with continual exploitation strategies utilizing remote management solutions for lateral movement, the potential for operational disruption appears significant.

As analysis of Qilin activity continues, there is an apparent increase in their presence, specifically a doubling of disclosures noted on the group’s data leak site since February 2025. The possible realignment with affiliates from RansomHub, particularly after its data leak site was taken offline, signifies an urgent need for organizations to be vigilant.

Exploitation of Legacy PowerShell Versions

An interesting insight was observed with ransomware actors utilizing PowerShell 1.0, despite the existence of more secure and updated versions. Around one-third of ransomware engagements showcased this outdated version, enabling attackers to bypass modern security features like script block logging and prevent detection by endpoint solutions. This tactic demonstrates a strategic choice on the part of attackers to leverage older technology to maintain stealth operations within compromised environments. For instance, PowerShell 1.0 was used to alter antivirus settings to evade monitoring—an insidious maneuver contributing to a quieter operational footprint and enhancing adversarial effectiveness.

Industry Targeting Trends

The education sector emerged as the most targeted industry during this quarter, in stark contrast to the previous quarter where engagements targeting educational institutions were notably absent. This uptick aligns with similar patterns observed in earlier reports, where education saw an increase in ransomware activity in the spring months. Given the ongoing vulnerabilities within educational IT systems, this trend underscores the importance of heightened vigilance and protective measures within this sector.

Initial Access Points and Vulnerability Trends

Notably, phishing constituted the main vector for initial access, followed by exploitation of valid accounts and public-facing application vulnerabilities. As organizations adapt by strengthening their defenses, these channels remain ripe targets for cybercriminal exploitation.

Recommendations to Address Key Security Vulnerabilities

Given the alarming statistics and evolving threats observed in Q2 2025, organizations must prioritize robust security practices to mitigate risk.

MFA Implementation and Configuration

This quarter showed that over 40 percent of engagements included issues with MFA, ranging from misconfigurations to outright bypass. Attackers often exploited systems with self-service MFA configurations, adding their devices as authentication methods. Talos IR recommends firms closely monitor registrations of new devices, implemented bypass codes, and the creation of accounts designed to navigate around MFA protocols.

Enhancing Logging and Monitoring Capabilities

Many engagements highlighted deficiencies in logging systems, hampering effective incident response measures. Implementing a centralized Security Information and Event Management (SIEM) system can preserve essential log data and provide a comprehensive overview for forensic investigations. The guidance here aligns with the vital importance of prompt incident responses, which can significantly influence the outcomes of cyber events.

Strengthening Endpoint Security Solutions

A concerning quarter-on-quarter increase was observed in incidents involving the tampering of endpoint detection and response (EDR) solutions. Organizations must ensure that EDRs are fortified with secure configurations and agent passwords, going beyond default settings to prevent adversaries from disabling vital defensive capabilities.

Conclusion: Navigating the Evolving Threat Landscape

As organizations strive to navigate this complex threat environment, ongoing adaptations in defense mechanisms will be essential. Cybercriminals are refining their tactics, especially through credential harvesting and sophisticated ransomware deployments. The trajectory of emerging threats, such as the growing Qilin ransomware incidents and persistent phishing attacks, puts an onus on all organizations to reassess their cybersecurity posture. Staying ahead in this rapidly changing landscape will require vigilance, quick responses, and a proactive approach to security best practices.

For future observations, organizations should continuously monitor the developments surrounding ransomware trends and the evolving methods used in phishing attacks, adapting their response strategies accordingly to safeguard their environments.