Kaspersky data shows AI-themed phishing lures achieve 45 percent click rate
New analysis reveals that technology, healthcare, and HR-themed emails trick employees most often, with some specific lures reaching near-universal engagement.
Key points
- AI and tech-themed phishing emails achieved a 45 percent click-through rate in Kaspersky testing.
- Emails regarding sanitary inspection reports tricked 92 percent of recipients in the healthcare category.
- Regular awareness training was found to dramatically reduce phishing susceptibility across organizations.
Kaspersky researchers reported that phishing campaigns themed around artificial intelligence and technology achieved the highest engagement rates, with a 45 percent click-through rate in recent testing. This finding comes from an analysis of anonymized, voluntary data collected through the company’s Phishing Simulator tool, which aims to help businesses understand the specific risks present in employee inboxes.
The study identified five primary topics that yield the best results for attackers: AI and tech, healthcare and insurance, IT policies and compliance, gifts and promotions, and human resources communications. Kaspersky stated that high click rates clearly highlight what specific cybersecurity training is required to protect users from these targeted social engineering attempts.
Effectiveness of Specific Themes
Within the healthcare and insurance category, lures tricked an average of 28 percent of the audience, but one specific type of email proved exceptionally dangerous. Emails claiming to contain a sanitary inspection report reached a 92 percent click-through rate, meaning nearly every recipient opened the malicious link. IT policies and compliance messages followed with a 26 percent click rate, while gifts and promotions achieved a 24 percent success rate.
In the gifts and promotions category, two-thirds of recipients clicked an email inviting them to wear their national team’s football jersey to win a prize. This suggests that highly specific, culturally relevant incentives can bypass standard skepticism. Researchers noted that these themes work because they combine a sense of urgency with the fear of missing out or suffering material troubles.
Impact on Human Resources and Internal Comms
Human resources and corporate communications yielded a 22 percent click-through rate overall, but Kaspersky warned that emails raising sensitive and high-interest internal topics are especially dangerous. People naturally respond to sensitive and highly contextual emails, particularly when the phishing attempt mimics their exact workflow or local specifics. This mimicry allows attackers to blend in with legitimate internal correspondence, making detection difficult for untrained eyes.
The data indicates that no two emails are alike, but some campaigns prove significantly more successful than others. By analyzing which themes fail and which succeed, Kaspersky aims to give businesses better insight into the biggest risks lurking in their employees’ inboxes. The high success rates underscore the need for targeted training rather than generic security advice.
What should you do?
Organizations should review their current phishing simulation programs to ensure they cover the high-risk themes identified by Kaspersky, including AI, healthcare, and HR topics. Security teams can use click-rate data to tailor awareness training, focusing on the specific lures that trick the most employees. Regular training is essential, as researchers found it can dramatically reduce susceptibility across organizations.
Background: Social engineering
Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.
Read the full guide: Social Engineering Warning Signs and How to Respond
What to do and how to stay safe: Kaspersky
- Analyze internal click-rate data to identify which specific themes, such as AI or HR, trick your employees most often.
- Update awareness training modules to include examples of high-success lures like sanitary inspection reports or tech announcements.
- Encourage employees to verify urgent requests regarding sensitive internal topics through a secondary communication channel.
- Monitor for emails that mimic exact workflows or local specifics, as these are particularly dangerous and harder to detect.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which phishing theme had the highest click-through rate?
AI and technology-themed phishing lures achieved the highest click rate at 45 percent, according to Kaspersky data.
What specific email type had a 92 percent click rate?
Emails regarding a sanitary inspection report in the healthcare and insurance category reached a 92 percent click-through rate.
How can organizations reduce phishing susceptibility?
Researchers found that regular awareness training can dramatically reduce phishing susceptibility across organizations.
