Barracuda Finds That 23% of HTML Email Attachments Are Malicious
Tuesday, May 6, 2025
New Barracuda Report Highlights State of Email Threat Landscape in 2025
CAMPBELL, Calif., April 28, 2025 /PRNewswire/ -- Barracuda Networks, Inc., a leading cybersecurity company providing complete protection against complex threats for all sized businesses, today released the 2025 Email Threats Report, which details the current state of email-based risks facing organizations worldwide, based on Barracuda's threat detection data. The findings highlight how attackers continue to shift malicious links and content to attachments in the hope of evading detection by security tools. Advanced AI-based threat detection is critical for detecting such hidden threats.
As many as 20% of organizations experienced at least one attempted or successful account takeover (ATO) incident per month, with attackers typically trying to gain access through phishing, credential stuffing or by exploiting weak or reused passwords. Once inside an account, attackers can steal sensitive data, move laterally inside the organization, and send phishing emails that appear to be from a trusted source.
The findings show that:
-- 23% of HTML attachments are malicious, making them the most weaponized
text file type. More than three-quarters of the malicious files detected
overall were HTML files. When used legitimately, HTML attachments in
emails enable organizations to share content, such as newsletters or
invitations, that display properly when opened in an email client or web
browser.
-- 68% of malicious PDF attachments and 83% of malicious Microsoft
documents contain QR codes designed to take users to phishing websites.
-- Bitcoin sextortion scams account for 12% of malicious PDF attachments.
-- 47% of email domains do not have Domain-based Message Authentication,
Reporting and Conformance (DMARC) configured to protect against
unauthorized use, including spoofing and impersonation attacks.
-- 24% of email messages overall are now malicious or unwanted spam.
"Email remains the most common attack vector for cyberthreats because it provides an easy entry point into corporate networks," said Olesia Klevchuk, product marketing director, Email Protection at Barracuda. "Malicious email attachments, QR codes and URLs are used by attackers to distribute malware, launch phishing campaigns and exploit vulnerabilities. Many organizations increase their risk level by failing to implement DMARC, making it possible for attackers to impersonate their brand and implement fraudulent attacks. Organizations need to mitigate the risks by implementing best practice industry standards and adopting a multi-layered approach to email security, leveraging AI-driven threat detection to spot attacks hidden in attachments and malicious websites."
To learn more about the email threat landscape in 2025 and best practice security recommendations, please see the full 2025 Email Threats Report.
This report contains proprietary Barracuda research gathered during February 2025. During that time, nearly 670 million malicious, spam or unwanted emails were analyzed. The report presents the key findings from that data.
About Barracuda
Barracuda is a leading cybersecurity company providing complete protection against complex threats. Our platform protects email, data, applications, and networks with innovative solutions, and a managed XDR service, to strengthen cyber resilience. Hundreds of thousands of IT professionals and managed service providers worldwide trust us to protect and support them with solutions that are easy to buy, deploy, and use. For more information, visit barracuda.com.
Barracuda Networks, Barracuda and the Barracuda Networks logo are registered trademarks or trademarks of Barracuda Networks, Inc. in the U.S., and other countries.
Contact:?
Anne Campbell?
Barracuda Networks, Inc.?
978-328-1642?
acampbell@barracuda.com?
View original content to download multimedia:https://www.prnewswire.com/news-releases/barracuda-finds-that-23-of-html-email-attachments-are-malicious-302438371.html
SOURCE Barracuda Networks, Inc.
|
|
|
|
|
 |
Weekly Recap: 11 Tech Press Releases You Need to See | Jan 22, 2026
|
|
Sup AI Sets New Benchmark Record with 52.15% on Humanity's Last Exam | Jan 22, 2026
|
|
DEADLINE ANNOUNCED FOR 2026 NEW TOP-LEVEL DOMAIN APPLICATIONS | Jan 22, 2026
|
|
Trigent Partners with WeWork India to Expand its GCC Footprint | Jan 22, 2026
|
|
Skunk Works® and XTEND Expand Joint All Domain Command and Control for Advanced Mission Execution | Jan 22, 2026
|
|
Altair HyperWorks 2026 Delivers Design and Simulation at Scale with AI | Jan 22, 2026
|
|
Exia Labs Brings Keystone to the U.S. Navy via DIU's Blue Object Management Challenge | Jan 22, 2026
|
|
Glasswall Brings Defense-Level File Sanitization to Every Government Agency and Business Using Microsoft 365 | Jan 22, 2026
|
|
Genpact Named a Leader in ISG Provider Lens(TM) 2025 for Insurance GCCs and Agentic AI Services | Jan 22, 2026
|
|
Buyers Edge Platform Appoints Jaime Selga to Lead Expansion Across the Middle East, Africa & Asia | Jan 22, 2026
|
|
|
