Kaspersky’s statistics on training phishing campaigns targeting employees of Belarusian organizations for the period from January to October 2026 were presented at the “Cybersecurity 2027” forum.

An invitation to a mandatory cleanup event turned out to be the most effective “bait” in the campaign, with 23% of employees opening such a message. Other topics that attracted employees’ attention included the rescheduling of workdays and payslips. Eleven percent of employees clicked on the corresponding emails.

Employees reacted much less frequently to messages that mimicked official notifications. For instance, a fake alert from the Information Protection Center captured the interest of 3% of recipients, while a message about an undelivered email was opened by 2%. Almost no one responded to the notice about the start of an unscheduled audit. One percent of employees followed links in emails about a new annual bonus system and an expanded list of corporate services.

“Attackers subtly exploit work-related issues that provoke emotions and dull vigilance, such as mandatory participation in a cleanup event or receiving a payslip. Topics related to work processes become the most effective hook: a significant share of unwanted clicks falls on them,” experts in cybersecurity noted.

According to them, emails that masquerade as communications from HR or internal departments can be perceived by employees as trustworthy. Therefore, organizational protection must include not only technical measures but also regular staff training and the cultivation of a habit of verifying messages, even if they appear ordinary.

Experts noted that the restrained response of employees to certain types of training phishing may indicate increased vigilance toward suspicious notifications. At the same time, in real attacks, fraudsters are increasingly using artificial intelligence to create plausible emails that are difficult to distinguish from legitimate ones.

To reduce the risk of phishing attacks, experts recommend regularly training employees to recognize social engineering techniques, updating software, and using protective solutions for corporate email and devices. It is also important to use complex unique passwords for work accounts and store them in specialized password managers.