Identity

Bitcoin

Security

More than 5% of all emails sent worldwide contain malicious content, according to internet infrastructure giant Cloudflare.&nbsp;
The web security giant revealed that an aggregate of 5.6% of global email traffic analyzed by the firm over the past year was found to be malicious. This equates to more than one in every twenty emails containing harmful content.
In November, that figure surged to almost one in ten, nearly double the average for the year, it <a href="https://radar.cloudflare.com/year-in-review/2025#malicious-emails" rel="noopener noreferrer nofollow">found</a>.&nbsp;
Malicious emails include those that can cause harm, such as the theft of credentials, data, or money, Cloudflare explained in its 2025 year-in-review report.&nbsp;
The findings are particularly relevant to crypto investors, as phishing attacks targeting crypto traders, investors, and executives have increased in complexity and <a href="https://cointelegraph.com/news/phishing-scams-cost-users-12m-august-stay-safe" rel="noopener noreferrer nofollow">surged</a> in recent months.&nbsp;
Crypto phishing links can be especially damaging. Once a victim falls for one of these malicious links or sends cryptocurrency to a <a href="https://cointelegraph.com/explained/5-crypto-scams-you-can-t-ignore-in-2025" rel="noopener noreferrer nofollow">scammer</a>, there’s usually no way back.&nbsp;
<figure>
 <img src="https://s3.cointelegraph.com/uploads/2025-12/019b2567-5add-7736-98b6-6dd1f850929c.jpg" title="" alt="Over 1 in 20 emails are malicious, warns internet giant Cloudflare">
 <figcaption>
 Malicious emails surged to 9.7% in November. Source: <a href="https://radar.cloudflare.com/year-in-review/2025#malicious-emails" rel="noopener noreferrer nofollow">Cloudflare</a>
 </figcaption>
</figure>
<h2 id="deceptive-links-dominate-threat-categories">Deceptive links dominate threat categories&nbsp;</h2>
More than half of these malicious emails, or 52%, contained a deceptive link, which was the highest threat category, it reported.
Identity deception was the second-highest at 38%, up from 35% in 2024, as attackers impersonated trusted individuals using spoofed domains, similar-looking domains, or display name tricks.
Related: <a href="https://cointelegraph.com/news/email-auto-reply-malware-cryptocurrency-mining" rel="noopener noreferrer nofollow">Email auto-reply vulnerability allows hackers to mine cryptocurrency</a>
Cloudflare also revealed that the most abused top-level domain (TLD) extension was “.christmas,” with 92.7% malicious emails and 7.1% spam originating from this domain type.
Other highly abused domain names included “.lol,” “.forum,” “.help,” “.best” and “.click.”&nbsp;
<figure>
 <img src="https://s3.cointelegraph.com/uploads/2025-12/019b2567-5fc1-7961-bde9-fa149e9d0b6e.jpg" title="" alt="Over 1 in 20 emails are malicious, warns internet giant Cloudflare">
 <figcaption>
 Deceptive links were the highest threat category among malicious emails. Source: <a href="https://radar.cloudflare.com/year-in-review/2025#malicious-emails" rel="noopener noreferrer nofollow">Cloudflare</a>
 </figcaption>
</figure>
<h2 id="a-quarter-of-html-attachments-are-malicious">A quarter of HTML attachments are malicious&nbsp;</h2>
Earlier this year, researchers at cybersecurity company Barracuda <a href="https://www.barracuda.com/reports/2025-email-threats-report" rel="noopener noreferrer nofollow">analyzed</a> 670 million emails that were malicious or unwanted spam.
They discovered that email remains the most common attack vector for cyber threats, with malicious attachments and links being used to distribute <a href="https://cointelegraph.com/news/what-is-crypto-malware-and-how-to-detect-it" rel="noopener noreferrer nofollow">malware</a>, launch phishing campaigns, and exploit vulnerabilities.&nbsp;
As many as one in four emails were unwanted spam, a quarter of all HTML attachments were malicious, and 12% of malicious PDF attachments were Bitcoin scams, they reported.&nbsp;
In November,&nbsp;Hornet Security <a href="https://www.hornetsecurity.com/us/blog/cybersecurity-report-2026-press-release/" rel="noopener noreferrer nofollow">reported</a> that email was a “consistent delivery vector”&nbsp; for cyberattacks in 2025, with malware-laden emails surging by 131% year-over-year.&nbsp;
Magazine: <a href="https://cointelegraph.com/magazine/terraform-labs-do-kwon-bitcoin-price-choppy-action-hodlers-digest/" rel="noopener noreferrer nofollow">Do Kwon sentenced to 15 years, Bitcoin’s ‘choppy dance’: Hodler’s Digest</a>

Over 1 in 20 emails are malicious, warns internet giant Cloudflare

Table of Contents

Cointelegraph

Other articles published on Dec 16, 2025

Join our free newsletter for daily crypto updates!