International Threats: Themes for Regional Phishing Campaigns

By: Max Gannon, Intelligence Team

Cofense Intelligence relies on over 35 million trained employees from around the world, therefore a considerable number of analyzed campaigns are written in languages other than English. This report covers from May 2023 to May 2025 and focuses on the overall themes of campaigns in the top five most commonly seen languages besides English that bypassed perimeter filtering such as Secure Email Gateways (SEGs). Themes are valuable because they inform individuals what to be most suspicious of, can be used to help guide Security Awareness Training (SAT) by customizing content and phishing simulations, and enable a more rapid and informed response from Security Operations Centers (SOCs). 

This report is the first in a series of reports covering different trends in the top five non-English languages that Cofense sees. Other topics include the malware families and delivery mechanisms seen in different languages, as well as the embedded URLs that are used to deliver malware.

Languages Chosen

Within the time frame of this report, there were campaigns in 30 different languages that bypassed SEGs to deliver malware. Unfortunately, covering all of them would require more space than is feasible. As a result, the top five by volume were chosen to be featured. Those languages were Spanish, Turkish, Chinese, Portuguese, and German. Although the volume of these five could be compared and used to make claims about the volume of phishing campaigns against a specific language, that would be inaccurate as the individual shares of the whole are more likely to represent the distribution of customers reporting emails and a broad scoped collection area bias rather than a pattern of activity. 

As a result, the specific volumes of each language will not be compared, but several trends within each language will be examined. It is also important to note that language can often be taken as an indicator of regionality. For example, the vast majority of German language campaigns were received by individuals in Germany. Spanish and Portuguese language campaigns can be a bit more varied, but when it comes to this report it is safe to assume that the majority of campaigns in those languages were focused on Latin America rather than Europe.

Campaign Themes

The theme of a campaign is determined by several factors. The most influential factor is the subject, as that is the first thing recipients see. The next factor is the body of the email; this typically includes the spoofed brand as well as what is considered the primary language of the email (which can be different from the subject language in some cases). 

The names of any attachments or embedded images are then considered. In some cases, the body of the email is entirely an image or has very little text, so the attachments and embedded image names can be very relevant. Lastly, embedded URLs and the destination of the URLs are considered. 

Sometimes the brand and theme of the destination page differ greatly from that of the email; however, as the email is the first thing that is seen and arguably has more impact as to whether victims fall for a phish, the contents of the email are prioritized when determining the theme of a campaign. The themes laid out in Table 1 are considered the most common themes in each of the five most commonly seen languages. Any theme that saw less than 1% representation in a particular language is not covered. 

Table 1: Top subjects in leading themes in the top five languages.

Spanish Language Email Campaigns

Spanish language campaigns were overwhelmingly Finance or Legal related, this can be seen in Figure 1. This aligns with the most commonly spoofed brands in Spanish language campaigns: Republic of Colombia Labor Court, and the Office of the Attorney General of Colombia. 

These brands may also indicate that Spanish language campaigns most heavily target Colombia rather than other large Spanish speaking countries such as Mexico, Spain, or Argentina. Campaigns spoofing these brands were most often Finance-themed and delivered Async RAT. Spanish language campaigns saw the largest number of spoofed brands with 19 times more than Turkish language campaigns.

Figure 1: Top themes in Spanish language campaigns.

Table 2: Top subjects in leading themes in Spanish language campaigns.

Turkish Language Email Campaigns

In prior reports on non-English language campaigns, Thai or French qualified as being in the top five rather than Turkish. When it comes to delivering malware regardless of the method, Thai language campaigns have higher volume. When it comes to malware delivered via embedded URL, French language campaigns have higher volume. However, when it comes to the overall volume of phishing campaigns, Turkish language campaigns have higher volume than the others.

As can be seen in Figure 2, Turkish language campaigns were dominated by Finance-themes. This may indicate that threat actors consider Turkish language targets to be particularly susceptible to Finance-themed campaigns. Although there was some brand spoofing in Turkish language campaigns, the majority were brandless, with each brand accounting for less than 1% of the total Turkish language campaigns.

Figure 2: Top themes in Turkish language campaigns.

Table 3: Top subjects in leading themes in Turkish language campaigns.

Chinese Language Email Campaigns

As can be seen in Figure 3, Chinese language campaigns were, like all other non-English campaigns, primarily Finance-themed. While Chinese language campaigns saw more diversity in their themes than some other languages, they saw very little diversity in their spoofed brands. The only brand with more than 1% representation was China’s State Taxation Administration. Campaigns spoofing China’s State Taxation Administration were most often Finance-themed and typically delivered KrBanker.

Figure 3: Top themes in Chinese language campaigns.

Table 4: Top subjects in leading themes in Chinese language campaigns.

Portuguese Language Email Campaigns

Portuguese language campaigns saw the most variance in their themes, although Finance was still the dominant theme. Portuguese language campaigns also saw a large number of different brands spoofed, although none of them saw more than 1% representation. Portuguese language campaigns were one of only two languages to see a significant number of Travel Assistance-themed campaigns. These typically took the form of campaigns delivering either credential phishing or Vidar Stealer.

Figure 4: Top themes in Portuguese language campaigns.

Table 5: Top subjects in leading themes in Portuguese language campaigns.

German Language Email Campaigns

German language campaigns, seen in Figure 5, saw the second most variance in themes as well as the second most variance in brands. German language campaigns also saw a higher-than-average number of brands with over 1% representation. The spoofed brands include Deutsche Telekom, AutoScout24, and INTEC Engineering. Campaigns with these brands typically utilized multiple delivery mechanisms and delivered upwards of 3 Remote Access Trojans at the same time.

Figure 5: Top themes in German language campaigns.

Table 6: Top subjects in leading themes in German language campaigns.

Conclusion

Phishing attacks aren’t just in English anymore. Cybercriminals now use multiple languages to lure people into clicking URLs or opening malicious attachments. Phishing attacks that deliver malware increasingly exploit multiple languages to broaden their reach. Cofense Intelligence identified the top 5 high-volume languages used in such attacks: Spanish, Turkish, German, Chinese and Portuguese. By tailoring the phishing content to these languages, attackers increase the likelihood of deceiving users located internationally. These insights emphasize the need for multilingual cybersecurity measures, including user training, email filtering, and threat intelligence, to effectively mitigate the phishing attacks.

At Cofense, we are committed to helping organizations defend against today’s most advanced phishing attacks with speed, accuracy, and efficiency. Schedule a demo today to learn more.