Hygiene Phishing Emails Trigger High Click Rates
New Kaspersky research reveals employees are most likely to click on fake hygiene inspection reports.
Updated on Oct. 29, 2026 in Cybersecurity
Live Poll
Do you feel confident in your ability to identify a sophisticated work-related phishing email?
A phishing simulation analysis from Kaspersky reveals that emails posing as hygiene inspection reports achieved a 92 percent click-through rate. The study highlights how attackers successfully exploit business procedures to deceive employees.
Why it matters
Employees are significantly more likely to fall for phishing attempts that mimic essential work-related tasks rather than generic promotions. This trend underscores the evolving danger of social engineering in professional environments.
Phishing simulations mimicking hygiene inspection reports reached a 92 percent click-through rate, while FIFA-themed prize emails saw 66 percent engagement. Comparatively, internal HR communications and IT policy emails maintained much lower click rates of 22 and 26 percent respectively.
The players
Kaspersky
Kaspersky is a global cybersecurity company that provides threat intelligence and security awareness training to businesses and individuals.
The details
The investigation utilized an automated security awareness training platform to send realistic, deceptive emails that mirror standard business operations. These results indicate that attackers are gaining credibility by focusing on topics closely aligned with specific employee responsibilities.
Timeline
Kaspersky released its phishing simulation analysis findings on October 29, 2026.
The Tech Race
This research follows a pattern set by the rise of generative AI-powered social engineering, which continues to make personalized attacks more sophisticated. The findings suggest that as automation improves, the focus on human-centric security remains critical.
Employees should remain vigilant against emails requesting urgent approvals or inspections, as these professional mimics pose the highest risk of credential theft. Organizations can use these findings to prioritize training, which can help reduce vulnerability rates to as low as 5-7 percent.
The takeaway
Staff should verify the legitimacy of inspection or approval emails through secondary internal channels before clicking links. Adopting rigorous security awareness training is a proven method for significantly lowering an organization's susceptibility to phishing.
Further reading
For more information on preventing digital threats, visit the Cybersecurity section.
Source note: This article includes information reported by 조선일보.
Live Poll
Do you feel confident in your ability to identify a sophisticated work-related phishing email?
