3.8 million phishing attacks were recorded in 2025, a record level. And yet, this figure only tells part of the story.
What has really changed this year is not the volume of attacks but their ability to blend into the background of our daily online lives.
Phishing no longer looks like what we were taught to recognize. It no longer arrives only in the form of a poorly written email, from an unknown sender or a link to a suspicious domain. Today, it hides behind the tools we use every day, and it precisely exploits the trust we place in them.
URL shorteners, tools for marketing teams… and attackers
The most used service for hiding phishing attacks is called bit.ly. We’re not talking about a domain registered in Belarus at three in the morning, but the same URL shortener that corporate communications departments often use for their newsletters. This reveals a deliberate strategy: hijacking legitimate infrastructure to circumvent defenses.
When an email filter analyzes an email containing a bit.ly link, it sees a recognized, whitelisted service. The final destination (the credential theft page, the trapped form) remains invisible until the targeted victim clicks. Few secure web gateways (SWG) dynamically resolve these shortcuts on the fly, so the filter validates the link and the user passes the barrier.
Additionally, URL shorteners can fit into any modern attack technique. Quishing (QR code phishing), for example, uses a QR code which hides a TinyURL link which in turn hides the final page. Adversary-in-the-Middle attacks use t.co or is.gd as intermediaries to evade detection.
The observation for security teams is stark: the rule “check the URL before clicking” no longer holds when the URL is under construction hidden by a technically legitimate service.
Cloaking, when Google Ads becomes a vector of mass attack
Another equally worrying threat is that search engines have become a hunting ground. The scenario has become commonplace in 2025: an employee seeks to download Microsoft Teams, he types the request into Google, the first result displays a Microsoft logo, credible URL, official description… The employee does not notice the little “Sponsored” tag, he clicks, downloads, installs. But it wasn’t Teams, it was ransomware. Campaigns of this type target the most sought-after software in business: Teams, AnyDesk, VLC, Slack, ChatGPT. Names that everyone knows and is looking for.
The mechanism that makes this attack so difficult to counter is called cloaking. The attacker buys advertising space, clones the official website of the targeted software, then serves two versions of its page: a clean one, intended for Google’s verification bots, and a booby-trapped one, intended for real users. The malicious file itself is not hosted on a questionable domain, it is often on GitHub or Dropbox, platforms that almost all corporate filters allow.
The figures are dizzying: in 2024, a single campaign of this type has compromised a million devices, via advertisements broadcast on mainstream streaming sites. Today, one in 130 ads in search results is malicious.
Generative AI, a new unprotected vector
The threat now extends beyond traditional search engines into even less secure territory: generative AI interfaces. More and more employees are using ChatGPT or Perplexity to search for software, find links, get recommendations. However, these tools do not have the anti-phishing protections integrated into traditional browsers. A recent study reveals that one in three URLs suggested by these AI engines do not point to the official domain of the brand in question.
The “I search, I click” reflex is migrating towards AI, but not the solutions that protect us.
Implications for security managers
URL shorteners and malvertising share a common characteristic that makes them particularly dangerous: they exploit known, legitimate services that users trust. Faced with this reality, several measures are necessary:
On a technical level, SWGs must be configured to dynamically resolve URL shorteners before validating a link. Filtering by domain category alone is blind to the shortener + post-validation redirection combination. Behavioral analysis of landing pages becomes essential.
In terms of policies, it becomes necessary to regulate the use of shorteners within the organization’s internal tools. Not to prohibit them, but to distinguish legitimate uses from suspicious uses.
On the awareness side, historical messages (“check URL”, “beware of unknown senders”) should be updated. The real message today is more counterintuitive: a link can appear perfectly legitimate and lead directly to a compromise. Vigilance is no longer based on visual recognition of an anomaly but on understanding the risk. The first Google result could be an ad, bit.ly could hide anything, and the file downloaded from GitHub could be malicious.
Phishing no longer needs to be crudely disguised. It blends into the legitimate infrastructure of the Internet and exploits the blind spots of defenses built for a world where threats were, until recently, recognizable to the naked eye. The attack surface is no longer just technical, it is cognitive. And this is precisely why it is so difficult to defend with yesterday’s tools alone.
