Watch out — these are the phishing scams experts say are most likely to catch your workers out

Kaspersky finds AI and technology-themed phishing lures achieved the highest click rates, reaching 45% in testing Healthcare, compliance, promotions, and HR messages also proved highly effective at deceiving employees Researchers found regular awareness training can dramatically reduce phishing susceptibility across organizations Phishing emails are notorious for often working exceptionally well, but which ones are the most effective? We all know that these lures need two things: A) to carry a sense of urgency; and B) the idea that the victim will either miss out on something or suffer material troubles.

But no two emails are alike, and some campaigns prove to be more successful than others.

Security researchers Kaspersky set out to learn which themes work best, and which fail, to give businesses better insight into the biggest risks lurking in the depths of their employees’ inboxes.

To do that, they analyzed anonymized voluntary provided data from their Phishing Simulator.

“A high click rate among users clearly highlights what specific cybersecurity training is required,” they said.

Responding to sensitive emails The data showed five topics that yield the best results for the attackers: AI & Tech, Healthcare & Insurance, IT Policies & Compliance, Gifts & Promotions, and HR & Corporate Communications.

AI & Tech was the best-performing topic overall, with themes such as “introducing next-gen artificial intelligence” having a 45% click-through rate.

In other words, almost every other recipient would click on a malicious link and potentially get served malware or share login credentials with threat actors.

Healthcare & Insurance lures tricked an average of 28% of the audience, but among the different emails, one stood out.

Emails regarding a sanitary inspection report reached a 92% click-through rate.

IT & Policies were third with a 26% click-through rate, followed by Gifts & Promotions (24%).

Two-thirds (66%) of recipients clicked an email inviting them to wear their’ national team’s football jersey and win a prize.

HR & Corporate comms yielded a 22% click-through rate, with emails raising sensitive and high-interest internal topics being “especially dangerous”, Kaspersky said.

“People naturally respond to sensitive and highly contextual emails, especially when phishing mimics their exact workflow or local specifics.