According to fresh ANY.RUN data, phishing exposure remains above 70% in several critical industries. This doesn’t happen because organizations aren’t protected enough. Companies have been implementing email filtering, MFA, and phishing-awareness training for years.
However, threats continue to evolve, and security methods that were highly effective yesterday can develop visibility gaps as attackers adapt.
In this article, ANY.RUN explores data-driven insights to get to the bottom of phishing risk across key industries in the United States and examines how SOC teams can mitigate it.
See our previous article on phishing risk among US-based financial organizations.
Key Executive Takeaways
- Phishing remains a cross-industry risk. Exposure is consistently high across critical US sectors, making it an organization-wide concern rather than an isolated email-security problem.
- Email is only the beginning of the attack chain. Archives, PDFs, links, redirects, and post-click activity create visibility gaps that email controls alone cannot cover.
- Phishing is increasingly targeting identity and access. AiTM, session theft, token abuse, and user-driven execution make attacks harder to detect and contain with traditional controls alone.
- Speed and visibility are critical to reducing exposure. Behavioral analysis helps SOC teams uncover evasive activity quickly and move from suspicious content to informed response faster.
Phishing Risk Remains High Across Critical Industries
| Industry | Key ANY.RUN Data | Impacted Business Processes & Operational Risks | Priority SOC Action |
|---|---|---|---|
| Finance | 73.4% phishing exposure; 58.7% of analyzed files are emails | Credential theft, fraud, sensitive financial data exposure | Strengthen email and post-click threat analysis |
| Banking | ClickFix 71%, EtherHiding 63.8%, Sneaky2FA 62.3% prevalence | Session hijacking, credential compromise, unauthorized access | Detect AiTM, user-driven execution, and evasive activity |
| Manufacturing | 72.2% phishing exposure | Business disruption, sensitive data and system compromise | Detect and contain phishing chains before they progress |
| Government & Administration | 67.9% emails, 15.6% archives, 6.7% PDFs | Credential theft and compromise through document-based lures | Analyze attachments, links, and post-click behavior |
| Technology | Tycoon, Sneaky2FA, EvilProxy, ClickFix, EvilTokens among top threats | Credential, session, and access-token compromise | Prioritize identity-focused and post-click threat detection |
Across finance, banking, technology, manufacturing, and government phishing exposure reaches 69.9%, showing that phishing remains a widespread risk across critical sectors. The highest exposure levels appear in finance at 73.4% and manufacturing at 72.2%.
At this level of exposure, phishing is no longer just an email security concern. It is an organization-wide risk that requires consistent visibility, detection, and response.
Part of the reason behind those concerning numbers lies in how quickly threat actors evolve and adapt their techniques. AI makes convincing social engineering easier to scale, while techniques such as AiTM phishing and session theft make identity compromise increasingly difficult to prevent.
Explore broader threat landscape with H1 2026 Cyber Risk Report
Phishing campaigns increasingly combine sophisticated social engineering with identity-focused techniques, legitimate services, and evasive delivery methods.
The types of submissions most frequently analyzed in ANY.RUN’s Interactive Sandbox also show that email security alone cannot cover the entire attack surface. Across all five industries analyzed (finance, banking, technology, manufacturing, and government & administration), email messages account for 54.4% of submissions, followed by archives at 19.7% and PDFs at 9%.
For security leaders, this highlights the need to extend visibility beyond the email gateway. Email remains central, while the attack surface extends further into the files, links, and other content delivered through it. Effective phishing defense therefore requires visibility into what happens after delivery, including how suspicious content behaves once opened or executed.
The same pattern is even more pronounced in individual sectors. Finance and government & administration, for example, show particularly high shares of email-based submissions:
And it’s hard to blame users alone. Threat actors have become skilled at mimicking legitimate and niche documents, hiding payloads inside encrypted archives, and using techniques such as QR-code phishing to make malicious content harder to recognize at a glance.
Without enhanced visibility, modern phishing attacks can be difficult to unravel even for experienced security teams. Analysts need to see beyond the initial email or file and understand what happens after a user opens a document, follows a link, or interacts with a malicious page.
The Bigger Challenge: Phishing Is Becoming an Identity Attack
A deeper look at threats targeting critical sectors shows just how much the nature of phishing has changed. Email filtering, awareness training, and MFA can address parts of the phishing attack surface, but they cannot provide complete coverage against rapidly changing techniques.
Across all five industries analyzed, the leading threats by volume share are:
- Tycoon — 15%
- Sneaky2FA — 13.4%
- ClickFix — 10.4%
- EvilProxy — 9.8%
- EvilTokens — 6.5%
Together, these threats illustrate a broader shift: phishing no longer ends with detecting a malicious attachment. Leading threats increasingly involve credential theft, authentication session compromise, token abuse, and user-driven execution, expanding the attack surface beyond what traditional email security alone can see.
Tycoon and EvilProxy use AiTM phishing techniques to capture credentials and authentication data, while EvilTokens targets access tokens and authenticated sessions. Instead of simply trying to deliver malware, these attacks increasingly target the identities and access that organizations rely on.
PhaaS makes sophisticated phishing techniques easier to deploy at scale. AI makes lures more convincing and easier to personalize. AiTM and token theft demonstrate that protecting passwords alone may not be enough to prevent compromise.
More on ClickFix
ClickFix campaigns use fake errors, CAPTCHAs, or verification prompts to manipulate users into copying and executing malicious commands themselves. This allows attackers to turn social engineering into direct execution on the victim’s device. Read more on Malware Trends Tracker
More on Sneaky2FA
Sneaky2FA – a phishing-as-a-service (PhaaS) kit designed to steal credentials and authentication sessions through adversary-in-the-middle (AiTM) techniques. Read more on Malware Trends Tracker
All terms aside, what this means is that modern phishing chains can:
- manipulate users into executing commands
- intercept authentication sessions
- steal credentials or tokens
- abuse legitimate infrastructure
On top of that, attackers increasingly abuse trusted, legitimate services and infrastructure, making malicious activity harder for both users and traditional security controls to recognize.
All of this points to a major security gap: visibility. Blocking the original email is only one layer of defense. Your SOC needs more.
Mitigation: Gain Visibility Before Phishing Turns Into a Breach
Modern phishing attacks are built to evade static controls, abuse legitimate services, and hide malicious behavior behind user interaction. It takes enhanced threats visibility both into the wider threat landscape and malicious activity happening inside specific campaigns.
This is where behavioral analysis and threat intelligence can give defenders the upper hand.
Expose the Full Attack Chain in Seconds
Instead of relying only on the initial email, URL, or file, analysts can safely detonate suspicious content in ANY.RUN’s Interactive Sandbox and observe the attack as it unfolds. With its capabilities, SOC analysts gain an additional layer of visibility into malware and phishing behavior.
Automated Interactivity performs the actions needed to expose evasive behavior without repetitive manual effort, helping analysts investigate threats involving password-protected archives, CAPTCHAs, malicious QR codes, and other interactive attack chains. In-browser data inspection provides deeper visibility into browser activity, redirects, scripts, requests, and other artifacts involved in the attack.
Most importantly, all of this takes just seconds.
Average MTTD with ANY.RUN is just 14 seconds, with similarly fast detection across the critical industries: 16.3 sec for banking and 17 sec for technology.
The result is a much clearer and faster path from alert to response:
Suspicious email → Detonate safely → Reveal behavior → Identify the threat → Respond
Full-scale visibility into threat behavior, including evasive phishing, helps streamline daily SOC workflows and accelerate response before threats can progress further.
For SOC teams, this means:
- Faster threat detection: identify malicious behavior in seconds.
- Less manual investigation: automate repetitive interactions and analysis steps.
- Greater visibility: expose redirects, scripts, network activity, and complete attack chains.
- Faster response: move from suspicious artifact to informed action sooner.
- Reduced risk exposure: contain threats before they can progress across the infrastructure.
- Stronger privacy and compliance: keep sensitive investigations private and support enterprise security requirements.
These benefits translate into measurable improvements in real SOC workflows. As recently published customer case study proves, ANY.RUN allows security teams to save around 15 minutes per alert response:
Investigate Beyond a Single Phishing Attempt
A detected attack can also become a starting point for broader threat investigation.
With Threat Intelligence Lookup (TI Lookup), analysts can search threat data by industry, geography, malware, IOCs, techniques, and other parameters to understand whether suspicious activity is part of a wider campaign or relevant to their environment. AI-powered natural-language search makes this threat data easier to explore without constructing complex queries manually.
TI Lookup query: submissionCountry:”us” AND industry:”Manufacturing”
For organizations facing high phishing exposure, Threat Intelligence Feeds (TI Feeds) extends this visibility into daily detection and response workflows. Fresh, high-confidence IOCs derived from real-world investigations can be delivered directly into the existing security stack, helping teams detect emerging threats, enrich alerts, and respond without adding more manual work.
Together, threat intelligence and interactive sandboxing help SOC teams investigate threats faster, strengthen detection, reduce manual enrichment, and turn individual phishing incidents into actionable knowledge that protects the wider environment.
5 Insights Security Leaders Should Take Away
- Phishing remains a cross-industry risk. High exposure across all five industries makes phishing a persistent concern for critical US sectors.
- The attack surface extends beyond email. Files, archives, links, redirects, and browser activity can all form part of the phishing attack chain.
- Phishing increasingly targets identity and access. Credential theft, session compromise, token abuse, and user-driven execution are prominent across leading threats.
- The business impact extends beyond the initial compromise. Successful attacks can expose sensitive data and critical systems, enable unauthorized access, and lead to financial loss or operational disruption.
- SOC teams need visibility across the full attack chain. Behavioral analysis and current threat intelligence help uncover post-click activity, connect related threats, and accelerate detection and response.
Conclusion
Phishing remains heavily represented across finance, manufacturing, government, banking, and technology. Credential theft, token compromise, malicious execution, and multi-stage attack chains increasingly blur the line between phishing and identity attacks.
Reducing phishing risk therefore means more than stopping suspicious emails. SOC teams need fast behavioral visibility into what those emails, links, and files actually do.
With average detection times of 16–17 seconds in banking and technology, ANY.RUN’s Interactive Sandbox helps teams expose complex attack behavior quickly, while ANY.RUN Threat Intelligence lets them investigate the wider threat context by industry, geography, and related activity.
About ANY.RUN
ANY.RUN is a leading provider of interactive malware analysis and threat intelligence solutions trusted by 16,000+ organizations and 700,000+ security professionals worldwide, including 74 of the Fortune 100 companies.
Its Interactive Sandbox and Threat Intelligence solutions help SOC teams analyze suspicious files and URLs, uncover malicious behavior, enrich alerts with actionable context, and connect related activity across files, infrastructure, and campaigns. This helps teams investigate threats faster, make more confident response decisions, and contain malicious activity before it creates wider business impact.
0 comments