Blocked-email counts are slipping, but that does not mean phishing is getting safer. Zscaler says attackers are concentrating on smaller business-themed campaigns that blend into routine work, so inbox volume now undercounts the risk that matters: one credential that opens email, files, chat, and connected SaaS.
The report puts phishing activity down about 20% in both 2024 and 2025 after a 58% surge in the year after ChatGPT appeared. It also says the services sector saw a 65.5% year-over-year jump, with lures built around billing notices, onboarding, renewals, support, and document sharing, often using Microsoft and Google impersonation and cloud-hosted or AI-generated pages.