Cybersecurity threats across Europe are accelerating at a pace significantly higher than the global average, according to a newly released analysis from Proofpoint. Organizations throughout the region are confronting an escalating volume of email attacks, growing interest from both profit-oriented and state-sponsored groups, and malware infections that impact businesses regardless of their size or sector.
Proofpoint telemetry indicates a dramatic spike in email-borne attacks across the continent. Detections per million inbound messages rose 3.2 times across Europe, with researchers detecting 4.5 times more phishing emails compared to previous metrics, vastly outpacing the more modest 1.5 times growth observed in the rest of the world. Business Email Compromise attacks represent a major portion of this threat landscape. In these incidents, attackers compromise accounts to impersonate colleagues or clients, requesting unauthorized wire transfers or sensitive access. European electronics companies face 3.4 times more BEC emails than the regional average, heavily featuring supply-chain invoice fraud.
Key takeaways
- Proofpoint detected 4.5 times more phishing emails in Europe this year compared to previous periods.
- European users click on threat emails at a rate of 8.3 per 100, compared to 2.0 worldwide.
- Telephone-oriented attack delivery rose 262% year-on-year, heavily impacting healthcare and hospitality.
- Attacks targeting open-source AI building blocks like Langflow and LiteLLM increased 4.6 times.
Industry Targeting and Human Factors
Different sectors face distinct threat patterns. Hospitality and leisure organizations are predominantly targeted by malware, accounting for 21% of all detections compared to 11% globally. Telephone-oriented attack delivery, commonly known as callback phishing, surged by 262% year-on-year. Healthcare organizations have also experienced heavy targeting, with callback phishing increasing by 257% and malware attacks rising by 84% compared to previous baselines.
A critical factor explaining why Europe remains a primary focus for threat actors is user responsiveness. Proofpoint data shows that for every 100 threat emails delivered in Europe, users clicked 8.3 times, compared to a global average of just 2.0 clicks. Established state-sponsored threat groups from Russia and China, including prolific actors like TA395 and webmail-targeting TA488, continue to evolve their techniques. Additionally, researchers noted that threat actors from India and Pakistan are increasingly shifting their focus toward Western Europe.
Artificial Intelligence and Cloud Infrastructure Risks
Artificial intelligence adoption is creating additional visibility and identity control vulnerabilities for enterprises. Proofpoint observed more than 188,000 AI-enabled applications connected through authentication and OAuth frameworks. While these applications automate workflows at machine speed, they introduce significant identity management risks.
Threat actors are actively exploiting these connectivity mechanisms by targeting content grants, tokens, and misconfigured applications. Cloud-based attacks impacted 64% of targeted European organizations through precision methods like phishing and session hijacking, with nearly all local entities facing some form of cloud threat. Attackers are also going after open-source AI technologies, with European sensors affected by attacks targeting building blocks such as Langflow and LiteLLM increasing 4.6 times between consecutive 90-day periods.
Comments