What phishing emails are often opened by employees of organizations, said cybersecurity experts

Kaspersky statistics on training phishing mailings for employees of Belarusian organizations for January - October 2026 were presented at the Cybersecurity 2027 forum. Belta reports.

An invitation to a mandatory Saturday became the most effective “bait” in the newsletter, such a letter was opened by 23 percent of employees. Other topics that attracted the attention of staff included the postponement of working days and payment sheets. 11 percent of employees clicked on the corresponding letters.

Staff were much less likely to respond to messages simulating official notices. Thus, a fake alert from the Center for Information Protection interested 3 percent of recipients, a message about an undelivered letter — 2 percent. Almost no one responded to the notification of the start of an unscheduled inspection. 1 percent of employees clicked on links in letters about the new system of annual bonuses and the expansion of the list of corporate services.

“Attackers subtly exploit work issues that provoke emotions and dull vigilance, such as being required to turn up on a Saturday or receiving a checklist. Topics related to workflows are becoming the most effective hook: they account for a significant proportion of unwanted transitions, said cybersecurity experts.

Emails that masquerade as mailings from HR or internal services may be perceived as trusted. Therefore, the protection of organizations should include not only technical means, but also regular training of personnel, as well as the formation of a habit of checking messages, even if they look ordinary.

Experts noted that the restrained reaction of employees to some types of training phishing may indicate an increase in alertness to suspicious notifications. However, in real-world attacks, fraudsters are increasingly using artificial intelligence to create believable emails that are difficult to distinguish from legitimate ones.

To reduce the risk of phishing attacks, experts recommend regularly training employees to recognize social engineering techniques, update software and use security solutions for corporate mail and devices. It’s also important to apply complex unique passwords to work accounts and store them in dedicated password managers. Investigators remind parents why it's important to monitor children's online activities