SOCshare: cybersecurity landscape in October 2025
Phishing attempts on the rise
During October we have repeatedly witnessed multiple phishing attempts. Content involved various techniques – from malware delivery, to phishing links for credentials harvesting. One thing stood out – is that more phishing e-mails come from legitimate, but compromised mailboxes. This helps attackers evade detections and spam filter.
ClickFix attacks
ClickFix attacks remained present, active, and notably successful throughout October 2025, continuing to exploit user trust and habitual behavior. These campaigns mostly relied on fake Cloudflare CAPTCHA pages, which were used to create a false sense of legitimacy. Victims were typically instructed to “verify” access or “fix” an issue by clicking through the CAPTCHA, ultimately leading them to execute malicious commands.
What Else Happened in October 2025?
- Rise in cyber incidents across Europe and Baltic countries. Estonia recorded 1057 incidents with an impact, which is a higher indicator than the average of the last six months.
- Lithuania hosted a national cybersecurity forum, where leaders and tech experts discussed increasing threats and deepened international cooperation.
Key takeaways
Where to pay attention to
Looking Ahead
Organizations should focus on:
- Improving detection mechanisms for ClickFix type of attacks
- Improving resiliency via trainings and education of users, how to recognize tactics used by threat actors.
October 2025 showed how threat actors are innovating within familiar attack vectors like phishing while also diversifying their tactics with advanced malware capabilities. Traditional defenses based solely on signatures or blacklists are increasingly insufficient.
Behavioral and contextual detection, combined with human awareness and regional cooperation, are now essential pillars of a resilient cybersecurity posture.
References
- https://www.ria.ee/en/situation-cyberspace-october-2025
- https://www.mfa.lt/naujienos/141/lietuva-stiprina-lyderyste-kibernetinio-saugumo-ir-kibernetines-diplomatijos-srityje:45071
This entry is published as part of the SOCshare project (No. 101145843), which we are running together with Vilnius City Municipality. It is partly funded by the European Union. The views and opinions expressed are those of the authors alone and do not necessarily reflect those of the European Union or the European Cyber Security Centre of Excellence. Neither the European Union nor the European Cyber Security Centre of Excellence can be held responsible for them.
Other news and stories
