IBM X-Force 2025: Phishing & Infostealers on the Rise

The IBM X-Force 2025 Threat Intelligence Index shows a rise in infostealers delivered via phishing emails and credential phishing. Organizations must limit their exposure as part of their threat management strategy.

Below are some of the report’s findings.

The report notes that “threat actors are using AI to build websites and incorporate deepfakes in phishing attacks. We have also observed threat actors applying gen AI to create phishing emails and write malicious code.”

“Year-over-year, X-Force is seeing a rise in infostealers delivered via phishing emails and credential phishing. Both result in active credentials that may be used in follow-on, identity-based attacks.

In 2024, we observed an 84% increase in infostealers delivered via phishing…Early data from 2025 suggests an even greater increase of 180% of weekly volume compared to 2023.”

“For the second year in a row, attackers adopted more stealthy and persistent attack methods, with nearly one in three attacks that X-Force observed using valid accounts. A surge in phishing emails distributing infostealer malware and credential phishing fuels this trend, which may be attributed to attackers leveraging AI to scale attacks.”

“It is almost impossible to trace back to the origin of the compromised credentials. It is likely that, for many valid accounts incidents, the actual infection vector was a premeditated credential phishing or infostealer malware campaign, a fact that cannot be accurately reflected in the statistic of initial access vectors.”

“Although by the numbers it might seem like phishing risks are decreasing, it’s just become more challenging to determine where the risk originated. Valid credentials still must be sourced from somewhere. While it can be difficult to prove, most compromised credentials came from infostealers and credential harvesting campaigns, of which an increasing amount is delivered via phishing.”

“Credentials or data were stolen in nearly half of all cyberattacks, highlighting a growing challenge in securing both data and identities.”

“Threat actors are using valid credentials to log in; exploit unpatched vulnerabilities; and to a slightly lesser extent, phish their way in—with or without AI assistance. Organizations need to develop and run their own cybersecurity playbooks—seeking to identify exposures, assess risks, and mitigate incident impacts.”

The first step the report gives for threat management is to “Limit your exposure across the threat environment.”

An essential part of this is minimizing the exposure of employee PII across data broker sites, as threat actors routinely use this data for reconnaissance, phishing, and credential compromise.

Download the full report for more insights.