In 2025, the cyber security landscape saw a transformation with attackers increasingly exploiting the human element through multi-channel social engineering. Techniques evolved from traditional email phishing to more sophisticated methods, including voice phishing and victim-initiated attacks. Notably, the ClickFix technique gained traction, increasing by approximately 500% compared to the previous year and appearing in nearly half of all documented malware campaigns.

Attackers in 2025 have leveraged AI as a force multiplier, enhancing their capabilities in executing campaigns. This includes the use of AI-driven social engineering techniques and automation, which have reshaped the attack landscape. The integration of AI has allowed for more targeted and effective exploitation of vulnerabilities, particularly in social engineering attacks that manipulate user trust.

Voice-based social engineering emerged as a significant method for attackers in 2025, enabling them to gain initial access to major enterprises. This technique was notably used by groups like Scattered Spider and ShinyHunters, leading to high-impact breaches such as the compromise of Marks & Spencer and Jaguar Land Rover. These incidents highlighted the effectiveness of impersonation tactics, resulting in substantial financial and operational damage.