Employees are more likely to react to phishing emails about work changes, salaries, and daily tasks. These data for January–September 2026 are provided by Kaspersky Lab based on the results of training mailings.
The strongest reaction was caused by messages about the introduction of a dress code — 26% of users clicked on them. Almost as many (25%) opened emails about a change in application status. Another 21% clicked on messages reminding them to complete a corporate survey, and 19% — on emails about salary indexation.
Among other popular topics were an approaching deadline and a request to evaluate the performance of air conditioners in the office — 16% each. 15% of employees reacted to messages about an insurance company's refusal to approve a medical service. An unusual topic with mandatory participation in a subbotnik interested 13% of users.
According to experts, attackers rely on both emotionally significant topics and familiar work processes. Emails can masquerade as messages from HR, accounting, or other internal departments, which increases the risk of carelessly clicking on a link or opening an attachment.