- Kaspersky finds AI and technology-themed phishing lures achieved the highest click rates, reaching 45% in testing
- Healthcare, compliance, promotions, and HR messages also proved highly effective at deceiving employees
- Researchers found regular awareness training can dramatically reduce phishing susceptibility across organizations
Phishing emails are notorious for often working exceptionally well, but which ones are the most effective? We all know that these lures need two things: A) to carry a sense of urgency; and B) the idea that the victim will either miss out on something or suffer material troubles.
But no two emails are alike, and some campaigns prove to be more successful than others.
Security researchers Kaspersky set out to learn which themes work best, and which fail, to give businesses better insight into the biggest risks lurking in the depths of their employees’ inboxes. To do that, they analyzed anonymized voluntary provided data from their Phishing Simulator. “A high click rate among users clearly highlights what specific cybersecurity training is required,” they said.
Responding to sensitive emails
The data showed five topics that yield the best results for the attackers: AI & Tech, Healthcare & Insurance, IT Policies & Compliance, Gifts & Promotions, and HR & Corporate Communications.
AI & Tech was the best-performing topic overall, with themes such as “introducing next-gen artificial intelligence” having a 45% click-through rate. In other words, almost every other recipient would click on a malicious link and potentially get served malware or share login credentials with threat actors.
Healthcare & Insurance lures tricked an average of 28% of the audience, but among the different emails, one stood out. Emails regarding a sanitary inspection report reached a 92% click-through rate. IT & Policies were third with a 26% click-through rate, followed by Gifts & Promotions (24%).
Two-thirds (66%) of recipients clicked an email inviting them to wear their’ national team’s football jersey and win a prize. HR & Corporate comms yielded a 22% click-through rate, with emails raising sensitive and high-interest internal topics being “especially dangerous”, Kaspersky said.
“People naturally respond to sensitive and highly contextual emails, especially when phishing mimics their exact workflow or local specifics. Knowing this, cybercriminals make their traps more personalized and this trend is set to accelerate with the rise of generative AI,” said Svetlana Kalashnikova, Security Awareness expert at Kaspersky.
“Fortunately, proper cultivation of cyber vigilance demonstrates measurable risk reduction: regular training and attack simulations drastically reduce phishing susceptibility rates from 60% to a mere 5–7%, according to KASAP effectiveness analytics. To protect people and businesses from human-targeting threats, we strongly recommend that organizations implement ongoing cybersecurity awareness program for all employees.”
According to Kaspersky, phishing remains the most prevalent cyber-incident for businesses at any stage of growth and ranks top among incidents leading to damaging business consequences. At the same time, attacks on humans grow more sophisticated, faster, and broader in scope and are, thanks to Artificial Intelligence (AI) now becoming a multi-stage effort.
Spotting a phishing email
Before Artificial Intelligence (AI), phishing emails were relatively easy to spot. Since they were mostly written by threat actors who aren’t native English speakers, their language was rather clunky and could not properly convey the style or the tone set up by the legitimate company’s communications team.
AI has now made malicious emails almost indistinguishable from legitimate communications, pushing identification further down the infection chain: towards links and attachments, as well as the overall sentiment.
A few things remain the same for all weaponized emails: the sense of urgency. Most legitimate organizations would not threaten their customers with account suspensions within 24 hours. They would also not host their documents on unrecognizable third-party services, and would not share attachments in executable formats.
Double-checking the domain from which the email is being sent is still a good way to spot an attack, too. Most phishing emails originate from a stolen email address, or one created on a public service. The UK postal service does not have a Proton email account.
Therefore, raising awareness, training, and doing simulations, remains the number one way to defend in 2026.