One in four emails is malicious: Attacks are exploding, according to a report

As cyber-attacks and online scams are increasingly easier to implement with artificial intelligence, prevention campaigns are multiplying.

A few months ago, some social media scams made headlines, but a study shows that another communication channel is being used by malicious people...

One in four emails received is said to be malicious

Every year, the company Barracuda Networks produces very comprehensive reports on cyber-security, based on several hundred million emails. In its latest report 2025 Email Threats Report, which is publicly available, the company's findings are very alarming.

Indeed, according to the company, cyberattack threats are still very numerous and currently affect one in four emails, or 23% of emails. In addition to this very worrying figure, the organization has looked into the different ways in which cyber attackers operate.

Attachments trapped in your email inbox...

For this new report, the company took the time to more closely analyze the attachments sent in emails recognized as malicious or considered spam.

Unfortunately, some attacks that are more than 10 years old are still relevant, particularly due to default formatting by email clients. Although these software programs are rarely used in France, the automatic formatting of emails in HTML favors these attacks.

But, not to dwell on this flaw that some developers should correct, the Barracuda Networks report also highlights other types of attachments. Among them, we find a large number of PDF files.

In this study, we learn that these files most often lead to phishing attempts (or "fishing") or ransom demands in cryptocurrencies.

This study also highlights the latest innovations of these hackers, notably with QR Codes. As these have been increasingly used by the general public since the COVID-19 pandemic, they are now present in emails to refer to online scams.

A lack of caution among professionals

While more and more companies are now aware of cyber-attacks, this study unfortunately showed that few of them were taking real measures to protect themselves.

Among the weak points identified by Barracuda Networks, it would appear that 47% of the domains analyzed do not yet use DMARC (Domain-based Message Authentication, Reporting and Conformance), a solution which nevertheless makes it possible to prevent domain spoofing on the web.