The first quarter of 2025 saw major surges in data breaches, phishing attempts, and browser scams, as well as the rise of financial fraud and crypto scams, new reports from Gen found.

Gen, the owner behind Norton, Avast, LifeLock, MoneyLion, and more, released its Gen Threat Report, highlighting the most significant shifts shaping the global Cyber Safety landscape observed between January and March 2025.

Key report findings include a 186% surge in breached personal information, a 466% increase in phishing reports, growth in fake browser update scams by 17 times the previous quarter’s levels, and more than four million people protected from Scan-Yourself attacks. The report also documented the rise of mobile financial fraud and crypto-related US presidential inauguration scams.

“Online threats are evolving at a startling pace,” said Siggi Stefnisson, Cyber Safety CTO at Gen. “Attackers are moving away from broad, indiscriminate campaigns to highly personalised, AI-enhanced deception.

“Breached data and AI tools are giving cyber-criminals just enough personal information and design sophistication to more easily manipulate people. That’s why we constantly evolve our cybersecurity solutions to be an interactive partner in fighting scams and to be one step ahead of cyber-criminals.”

Data Breaches Escalate

Data breaches are on the rise, with a 36% increase in the number of breaches faced by companies compared to the last quarter. Individual breached records surged by more than 186%, revealing sensitive information such as passwords, emails, and credit card details.

Attackers employed more advanced infostealers like Lumma Stealer, making data compromised faster and harder to detect.

Phishing Scams

Reports of phishing scams rose by a staggering 466% compared to the previous quarter, now making up nearly 32% of all scam submissions to the Norton Genie scam detector.

According to the Norton Genie scam detector platform, phishing is the fastest-growing threat, second only to generic scams, which accounted for 51% of reports.

The good news, Gen noted, is that people are becoming more wary of potential phishing scams and reporting these messages.

Telemetry data reveals a growing number of phishing campaigns that abuse dynamic DNS services and subdomain providers, as well as free website builders to create deceptive login pages.

This means, that by mimicking legitimate login portals and leveraging trusted domains – like recent scams targeting login portals and leveraging trusted domains like recent scams targeting AT&T, Telstra and Xfinity customers—attackers make phishing attempts harder to detect and more likely to succeed.

Many of these campaigns create a sense of urgency for potential victims through emails claiming account issues or prompting people to review sensitive documents. Despite sometimes being poorly written, the use of familiar platforms and subdomain tricks allows these scams to bypass security filters and remain highly effective.

Recommended reading

• Comment | The Growing Threat of Third-Party Cyber Risks
• Is Third-Party Risk Now the Weakest Link in Cybersecurity?
• JPMorgan CISO Calls for ‘Urgent’ Overhaul of Third-party Vendor Security
• Is Bad Communication Behind the Rise of Third-party Risks?

Scams on the Rise

Gen said it helped protect over 4 million users from Scam-Yourself attacks in which individuals, through sophisticated deception, are manipulated into infecting their own devices. In one of the most striking evolutions of this type of scam that Gen observed this quarter, attackers are using AI-generated personas, deepfake influencers and hired actors.

They use these personas to deliver their malicious campaigns. This is primarily done through compromised YouTube accounts, leveraging interactive FakeCAPTCHAs and asking people to verify they are human but instead guiding them to give device permissions or download malware.

Fake Update Scams grew to over 17 times last quarter’s level. This type of Scam-Yourself Attack tricks people into installing malware under the guise of browser updates.

Financial Threats on Mobile and Crypto

Mobile financial threats continued to rise, fueled by increasingly sophisticated tactics that target people directly through their smartphones. Malware, like banking trojans, now exploit accessibility features to overlay fake login pages, stealing sensitive data such as crypto wallet credentials. Combined with an uptick in credit and transaction fraud alerts, there’s a growing trend of attackers focusing on mobile devices as gateways to people’s financial lives.

Digital currencies continue to be a target for financial threats. CryptoCore executed one of its most successful campaigns in early 2025, hinging on the US presidential inauguration. Attackers leveraged deepfake videos of public figures spread through compromised YouTube accounts to steal close to $4 million spread through more than 2,000 transactions.

Don’t Miss Scotland’s Biggest Tech Event!

Join us at DIGIT Expo West on 5th June at the SEC Glasgow. Get leading industry insights across AI, Cyber Security, and Data, and grow your network at Scotland’s largest gathering of tech leaders – with 1500+ attendees, 50+ speakers, and 50+ exhibitors.

Register your FREE place now at www.digitexpowest.com