Cybercriminals Target Outlook and Gmail, Evading Standard Email Security

The Q3 2025 Email Threat Trends Report from VIPRE unveils a steep 13% year-over-year increase in detected malicious emails, highlighting the relentless evolution of attacker tactics.

Analyzing 1.8 billion emails processed over the quarter, researchers identified more than 234 million spam messages, of which 26 million were marked as actively harmful, an increase fueled by surging credential-harvesting campaigns and advanced social-engineering ploys.

VIPRE’s real-time sandboxing mechanisms proved critical, intercepting nearly 150,000 previously unknown malicious attachments and over 67,000 novel malicious links that bypassed both conventional content filters and link analysis engines.

This subset, though less than 0.1% of total volume, represented some of the most dangerous threats, capable of circumventing traditional security postures and landing directly in users’ inboxes.

On average, their network caught 2.6 million spam emails per day, with content-based detection (52%) neck-and-neck with link-based detection (48%), reflecting attackers‘ adaptive approach in bypassing legacy filters.

Credential Harvesting: Outlook and Gmail are the Prime Targets

Credential harvesting remains the predominant goal of phishing attacks, with VIPRE’s Q3 report revealing that over 90% of such campaigns focused on compromising Outlook and Google mailboxes.

Attackers favor these popular platforms for both business and personal communications, seeking to maximize the breadth and scalability of their campaigns. The analysis found that malicious links were the primary vector, used in 65% of attacks, while attachments, overwhelmingly PDFs, accounted for 31% of campaigns.

Social engineering remains front and center, with impersonation tactics dominating BEC (Business Email Compromise) attacks. 63% of BEC attempts hinged on impersonating CEOs and executives, often steering conversations to non-monitored messaging apps like WhatsApp to evade monitoring.

AI-generated email bodies have surged, accounting for 57% of BEC samples, as threat actors leverage automation to create more convincing lures.

How Attackers Evade Standard Email Security

Threat actors exploit trusted sender sources and infrastructure to slip past standard email defenses. The report shows that compromised accounts (33%) and abused free relay providers (32%) are the leading sources of malicious emails.

Legitimate bulk mail services like SendGrid and Amazon SES are increasingly misused, blending malicious and commercial spam to crowd out detection.

Newly registered domains provide disposable infrastructure for short-lived attacks, while open redirect techniques and typo-squatting URLs help phishing links fly under the radar.

The overwhelming dominance of English (over 87% of samples) reflects the global reach of these campaigns, which target major business markets and leverage user familiarity with the language to appear legitimate.

Newly observed tactics, such as Apple TestFlight being co-opted to distribute iOS malware and the adaptive delivery of PDQ RAT trojans, further emphasize the need for layered, real-time email security that adapts as fast as attackers do.

The final takeaway: Static denylists and signature-based defenses are no longer sufficient. Organizations must invest in advanced behavioral analysis, sandboxing, and AI-powered detection to keep pace with cybercriminals targeting core business email platforms.

Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates