Trends Report on Phishing Emails in January 2025

**Executive summary:** In January 2025 AhnLab ATIP observed that phishing attachments accounted for 48% of detected attachment threats (down from 77% last month), with trojans at 44% and smaller proportions of infostealers, downloaders (notably Guloader), and exploits; the report highlights document-based phishing (Docx/Xlsx/HWP/PDF), increased use of AutoIt scripts to build executables, SnakeKeylogger information-stealers communicating via Telegram C2, and includes sample MD5 hashes and illustrative figures.