389% Increase in Account Breaches Driven by Phishing Services in 2025

Securitybrief.Co.Nz

389% Increase in Account Breaches Driven by Phishing Services in 2025

First seen 16 Jan 2026, 10:50 UTC • •32.7

Article Content

1 / 5

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

eSentire reported a significant rise in account compromises in 2025, with email-led intrusions linked to credential theft. The research, based on data from over 2,000 customers, indicated that account compromise constituted 55% of cyber attacks, marking a 389% increase compared to 2024.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 217d ago How this analysis works

More articles in this cluster (4)

Threat Graph

17 entities, 60 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (4)

Malware
Phishing
Ransomware
Supply Chain Attack

Campaign (1)

CastleLoader Attacks

Malware (4)

CastleLoader
Shai Hulud
Shai Hulud Worm
Tycoon2FA

Affected Platform (1)

Microsoft 365

Threat Actor (5)

Akira
BlackBasta
Interlock
Ransomhub
Sinobi

Tool (2)

EvilProxy
Flowerstorm

Relationships

Akira uses CastleLoader
Akira uses Shai Hulud
Akira uses Shai Hulud Worm
Akira uses Tycoon2FA
BlackBasta uses CastleLoader
BlackBasta uses Shai Hulud
BlackBasta uses Shai Hulud Worm
BlackBasta uses Tycoon2FA
Interlock uses CastleLoader
Interlock uses Shai Hulud
Interlock uses Shai Hulud Worm
Interlock uses Tycoon2FA
Ransomhub uses CastleLoader
Ransomhub uses Shai Hulud
Ransomhub uses Shai Hulud Worm
Ransomhub uses Tycoon2FA
Sinobi uses CastleLoader
Sinobi uses Shai Hulud
Sinobi uses Shai Hulud Worm
Sinobi uses Tycoon2FA
Akira uses EvilProxy
Akira uses Flowerstorm
BlackBasta uses EvilProxy
BlackBasta uses Flowerstorm
Interlock uses EvilProxy
Interlock uses Flowerstorm
Ransomhub uses EvilProxy
Ransomhub uses Flowerstorm
Sinobi uses EvilProxy
Sinobi uses Flowerstorm
Akira uses Malware
Akira uses Phishing
Akira uses Ransomware
Akira uses Supply Chain Attack
BlackBasta uses Malware
BlackBasta uses Phishing
BlackBasta uses Ransomware
BlackBasta uses Supply Chain Attack
Interlock uses Malware
Interlock uses Phishing
Interlock uses Ransomware
Interlock uses Supply Chain Attack
Ransomhub uses Malware
Ransomhub uses Phishing
Ransomhub uses Ransomware
Ransomhub uses Supply Chain Attack
Sinobi uses Malware
Sinobi uses Phishing
Sinobi uses Ransomware
Sinobi uses Supply Chain Attack
CastleLoader Attacks attributed to Akira
CastleLoader Attacks attributed to BlackBasta
CastleLoader Attacks attributed to Interlock
CastleLoader Attacks attributed to Ransomhub
CastleLoader Attacks attributed to Sinobi
CastleLoader Attacks uses CastleLoader
CastleLoader Attacks uses Shai Hulud
CastleLoader Attacks uses Shai Hulud Worm
CastleLoader Attacks uses Tycoon2FA
Akira related to Microsoft 365

Following this threat?

Track Akira and CastleLoader in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Chinese Smishing Gang Targets Ireland and Four Other EU Countries Ireland is identified as one of five EU countries targeted by the Chinese text-scam group known as Smishing Triad, as reported by the EU cyber security agency Enisa. This group conducts large-scale smishing operations, which involve sending fraudulent text messages that impersonate legitimate organizations to steal…

Attackers Exploit MFA Gaps in SonicWall VPN Access On August 4, 2026, an Akira ransomware affiliate successfully accessed a SonicWall SSL VPN by spraying passwords, exploiting the lack of multi-factor authentication (MFA). After gaining access, the attacker used RDP to reach the domain controller and enumerate Active Directory, although the ransomware deployment…