Each spring, leading cybersecurity vendor SonicWall releases its annual Threat Report. Using data from across its global installation base as well as other expert sources, SonicWall's report provides guidance for future cybersecurity investments as well as advice on limiting disruption from cyber attacks.
In its 2025 report, the vendor highlighted common threats found in everyday files that can slip by even the most aware employees. File-based cyber attacks, specifically malicious PDFs and HTML phishing pages, gained momentum in 2024, with statistics showing that 38% of malicious files are HTML-based, with compromised PDFs closely behind at 22%. Also on the rise: Counterfeit mobile apps that trick users into entering payment and personal data.
Interested in the full report? Download your copy now
Most data breaches start with human error, and cyber criminals continue to find new ways to slide past network defenses using commonplace files such as emails, PDFs, and QR codes that depend on that human factor. Bad actors use this approach because it's easy to evade security and exploit employees to steal valuable info such as login credentials or slip ransomware onto unguarded devices.
The most common approach lures victims to phishing sites through embedded QR codes inside malicious PDFs that appear to be from trusted sources. Once the victim scans the QR code, he or she is redirected to what appears to be a legitimate login page. In reality, the credentials entered are sent to hackers and used to further access IT environments or personal data.
Malicious PDF attacks using QR codes are often successful because of sophisticated HTML web pages that only further extend the appearance of a legitimate ask in the compromised PDF. These phishing pages often prefill the victim's email address to lend authenticity before prompting the user to enter their password. While some attacks are content with the victim's credentials, others download malware onto the network or device of the victim, or send follow-up emails that deliver other types of threats.
Other tricks include spoofing vendors commonly trusted by employees, such as Microsoft or a local banking institution. Much like common phishing email tactics, these spoofed websites may have only one small element out of place, such as an added or missing letter in a trusted URL or a slightly misspelled name. HTML files are a common format for web pages and can bypass some email security filters, making them a preferred method for attackers and an especially popular ransomware delivery method.
With such sophisticated, sneaky tactics, protecting yourself and your company requires awareness. Common steps to avoid problems include:
Gaining momentum last year was the use of fake mobile apps to compromise devices. These fake apps can be used for data theft, malware infection, financial scams, identity theft, and more:
Much like phishing emails and HTML pages, counterfeit apps are typically built to look and act like a trusted vendor app. And similar to those other tricky approaches, the best defense is to be overly skeptical about any download. Other tips for protecting yourself from fake mobile apps:
Cybersecurity best practices for guarding against these growing threat types may seem simple, but they are effective. Taking the extra time to review spelling, URLs, researching company names online, and manually typing in URLs to test them don't seem like much, but those easy steps can protect you and your employees from opening the door to bad actors. Cybersecurity awareness training for employees can be key to providing reminders for employees and keeping them updated on new types of threats and common tricks.