iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
KnowBe4’s December 3, 2024 announcement reported that HR- and IT-themed emails made up 48.6% of the globally top-clicked phishing types in its Q3 2024 simulated phishing tests. It also said QR-code campaigns were rising, while email-embedded links remained the leading attack vector. These are KnowBe4’s findings from simulated tests—not a census of real-world phishing messages.
What KnowBe4 reported in Q3 2024
KnowBe4’s release focused on the kinds of phishing lures that drew clicks in its Q3 2024 simulations. Its headline figure was 48.6%: the share of globally top-clicked phishing types associated with HR- and IT-related emails. That denominator matters. The figure does not mean that 48.6% of all phishing emails, employees, or real-world attacks involved those themes. The release does not disclose the sample size or full methodology, so the number should be read as a result reported by KnowBe4, not a population-wide estimate. KnowBe4’s December 3, 2024 announcement
The release separately cites KnowBe4’s 2024 Phishing by Industry Benchmarking Report, which found that about one in three users was susceptible to interacting with malicious links or fraudulent requests. That is a different measure from the 48.6% share of top-clicked phishing types; the two figures should not be combined or treated as interchangeable.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteWhat the lures and delivery methods looked like
HR and IT themes
HR- and IT-related messages were prominent among the simulated phishing types that drew clicks. KnowBe4 CEO Stu Sjouwerman said, “The prevalence of HR and IT-themed phishing attempts, coupled with emerging techniques like QR code integration, presents a complex threat landscape.” The quote appeared in the December 3, 2024 release.
#1 Best Overall
Links, attachments and spoofed domains
KnowBe4 described links embedded in email as the leading attack vector in its report. It also called attention to PDF attachments and spoofed domains as routes that can lead to ransomware or business email compromise. The announcement does not provide figures that would support ranking PDFs or spoofed domains against the leading link vector.
QR-code lures
The release reported a rise in campaigns using QR codes. Examples included HR policy-review reminders, urgent DocuSign signing requests, and Zoom meeting invitations. These examples show the kinds of themes the announcement highlighted; they are not an exhaustive list. Although QR-code phishing was on the rise, the release did not say it was the most common vector: it separately identified email-embedded links as the leading attack vector.
How current is this report?
“Latest” was part of the original 2024 announcement’s headline, not a current description of KnowBe4’s research. KnowBe4’s resource catalog now lists a later 2026 Phishing Threat Trends Report, Vol. 7. The catalog establishes that later research exists, but its listing alone does not provide the report’s full methodology or a publication date more specific than 2026.
Recommended Free Tools
A June 18, 2026 KnowBe4 Threat Lab article says the later Phishing Trends Report found that 86% of phishing attacks observed in the preceding six months involved some level of AI assistance. That is subsequent, vendor-reported context—not a finding from the Q3 2024 simulated tests. The same article describes an observed campaign using a language-model preamble, hidden noise tokens, and Unicode homoglyph substitution. These later observations should not be used to validate or extend the 2024 figures. KnowBe4 Threat Lab, June 18, 2026
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What employees and organizations can take from it
The practical lesson is to treat familiar workplace processes as possible phishing pretexts, not as proof that a message is legitimate. HR policy notices, IT requests, document-signing prompts, and meeting invitations can all be imitated; a QR code can conceal a destination just as a clickable link can. Verify unexpected requests through a trusted channel, and inspect the destination before opening a link or scanning a code. For organizations, the announcement recommends workforce training and a stronger security culture, but its figures alone do not establish how effective any particular training program or control will be.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
