The recent release of Zscaler’s ThreatLabz 2025 Phishing Report reveals a concerning rise in sophisticated, AI-driven phishing attacks, with Australia identified as one of the top ten most targeted countries globally. Analysis of over two billion blocked phishing attempts in 2024 pinpointed a significant shift in tactics among cybercriminals. These attackers are moving away from broad, indiscriminate phishing emails to more precise assaults on critical business departments, including IT, human resources, finance, and payroll. This evolution highlights a remarkable utilisation of artificial intelligence, which enables the creation of realistic and convincing phishing lures.

While the overall volume of phishing attempts has reportedly decreased by 20% worldwide—thanks in part to stricter email authentication protocols—this decline has not deterred attackers. Instead, they have adapted by launching more targeted campaigns, particularly in digitally evolving markets with lesser investments in security measures, such as Brazil, Hong Kong, and the Netherlands. Despite these trends, Australia remains a formidable target: it was hit by over 30 million phishing attempts last year, securing the eighth position globally in phishing activity.

Heng Mok, Zscaler’s CISO-in-Residence for the Asia Pacific and Japan, noted, “Australian organisations must remain vigilant to the evolving cyber threats that have become increasingly sophisticated with the support of AI.” This assertion is reinforced by findings from the Australian Cyber Security Centre, which indicates that the rise of AI has not only enabled automated spear-phishing techniques but also enriched social engineering tactics through the use of deepfake technology. A notable case study included in their 2023-2024 Annual Cyber Threat Report described an incident where AI-generated deepfakes manipulated an employee into authorising a fraudulent financial transaction during a video call.

Another critical aspect of this ongoing threat is the targeting of corporate executives, who are particularly vulnerable due to their broad access and decision-making power. Attackers increasingly utilise deepfake voice and video technology to enhance their social engineering strategies, making the identification of fraud more challenging for organisations. This trend extends across various platforms as cybercriminals are not confined to traditional email avenues; they are employing social media channels like Facebook, Telegram, and Steam for impersonation, malware delivery, and information gathering.

Zscaler’s report also highlights a burgeoning trend termed “Phishing-as-a-Service,” leveraging AI to generate counterfeit websites and personalised phishing messaging at an unprecedented scale. This further complicates the landscape, as attackers mimic legitimate AI tools to trick users into disclosing sensitive information. Complementing these insights, Trend Micro’s findings indicate that Australia’s cyber threat landscape remains both substantial and alarming, with nearly 72 million email threats identified in the first half of 2024 alone.

In response to these heightened threats, Zscaler advocates for a robust security posture involving Zero Trust architecture combined with advanced, AI-driven phishing prevention methods. This multi-layered approach aims to minimise attack surfaces, prevent initial breaches, mitigate insider threats, and safeguard sensitive data. The findings underscore an urgent call to action for Australian businesses to embrace enhanced cybersecurity measures, especially as 91% of organisations are planning to increase their cybersecurity budgets by 2025 in response to the growing prevalence of AI-powered threats.

As the battle against cybercrime intensifies, the adoption of proactive, sophisticated security strategies will be essential in defending against the rapidly evolving landscape of phishing attacks.

Reference Map:

Source: Noah Wire Services