The latest FBI’s Internet Crime Report reveals that phishing remains the most common cybercrime in the U.S., with over 193,000 complaints last year alone. But what’s more concerning than the volume is the shift in tactics – today’s attacks are cleaner, more convincing, and designed to fly under the radar. Experts at ZeroBounce recently compiled the most prominent developments in phishing, and have flagged four key tactics that even experienced users often miss.
- The Rise of Linkless Phishing. Phishing emails with no links, no attachments – just a short, seemingly harmless message like “Are you free for a quick call?” or “Can you help me with this task?” These messages are designed to bypass filters entirely and start a real-time con via phone or reply. “People are trained to spot suspicious links, but attackers have adapted by removing them altogether,” says Vlad Cristescu, Head of Cybersecurity at ZeroBounce. “Once you reply, they continue the impersonation, usually posing as a colleague or executive. If something feels off, don’t respond directly. Verify through another channel before engaging.”
- Repeated Login Requests. Attackers flood users with multi-factor authentication (MFA) push notifications after stealing login credentials, then follow up with an email pretending to be IT support urging them to ‘just approve one’ to stop the alerts. “This is psychological warfare more than technical trickery,” explains Cristescu. “It exploits a user’s frustration and trust in IT. If you’re receiving multiple MFA prompts you didn’t initiate, that’s not a glitch – it’s an attack. Pause, don’t approve, and escalate it immediately.”
- HTML Attachments Masquerading as Secure Portals. Some phishing emails are now hiding their payloads inside a simple HTML attachment that opens in your browser and mimics a login screen. These are particularly deceptive because they look like invoices, shared documents, or secure notifications. “Users think, ‘It’s just an HTML file, what harm could it do?’” Vlad Cristescu notes. “But one click can open a cloned login page that captures your credentials instantly. Companies should restrict HTML attachments unless essential, and users should treat unfamiliar HTML files the same way they’d treat a suspicious link – don’t open it unless you’re absolutely sure of the sender.”
- Phishing Through Calendar Invites. Attackers are now sending meeting requests with malicious links embedded in the invite or ‘Join’ button. These invitations sync directly into calendars and often go unquestioned. “Calendar invites carry this built-in credibility – they’re not usually scrutinized like emails,” Cristescu explains. “But if you’re getting meeting requests from unknown senders, or vague event titles like ‘Sync’ or ‘Project Review,’ treat those just like a phishing email. Disable auto-accept where possible and review every invite manually before clicking anything.”
The Expert Takeaway
Modern phishing is strategic. The more it looks like business as usual, the more dangerous it becomes.
“The biggest risk today is overconfidence,” warns Vlad Cristescu, Head of Cybersecurity at ZeroBounce. “No matter how experienced you are, if you stop questioning what lands in your inbox – or your calendar – you’re vulnerable. Awareness must evolve as fast as the threats do. Always verify the sender’s email address, ensure that any link you click matches the legitimate domain, and look out for subtle red flags like spelling errors or unusual formatting. These small checks can make the difference between staying secure and falling for a well-crafted scam.”