Five Shady Phishing Email Techniques We Spotted in 2025

Huntress outlines five effective phishing techniques seen this year—voicemail lures using SVG/HTML that redirect to fake Microsoft logins (often via the Raccoon0365 kit), callback phishing with bogus support numbers, brand impersonation leveraging open-redirects to attacker pages, shipping notifications employing ASCII QR codes to evade scanners, and “Living off Trusted Sites” that pivot through trusted services like Figma/Dropbox with CAPTCHA/Turnstile interstitials—highlighting obfuscation and pre-populated email tactics, and recommending awareness training, MFA, email filtering, and clear reporting processes to mitigate risk.