Off the Hook - Don't be Phished this Cybersecurity Month!

The European Cybersecurity Month (ECSM) is the European Union’s annual campaign dedicated to promoting cybersecurity among EU citizens and organisations. Promoted by EU Member States as well public and private organisations across Europe, ENISA together with the European Commission, support this initiative to bring cybersecurity awareness across Europe.

Executive Vice-President for Technological Sovereignty, Security and Democracy, Henna Virkkunen, said: “Cybersecurity is not just about technology, it is a critical condition for all sectors of society and a shared responsibility. Phishing attacks and other cyber threats can have devastating consequences, disrupting our critical infrastructure and businesses, and undermining our trust in the digital world. By staying vigilant and taking simple steps to protect ourselves online, we can all play our role in fighting against cyber threats while helping to build a safer, more secure digital future for everyone.”

ENISA Executive Director, Juhan Lepassaar added: "The activities, part of European Cybersecurity Month, provide an important occasion to highlight the need for cybersecurity if we want each citizen to reap the benefits of a secure digital EU market.”

Phishing – thorn in my (web)site 

ENISA finds that phishing remains the primary initial intrusion vector, accounting for approx. 60% of cases. Phishing continued to be the primary method for initial intrusion, remaining an effective technique to carry out cyberattacks.

Phishing can occur in many ways such as deploying fake CAPTCHA prompts on compromised or fraudulent websites, which trick users into executing commands under the pretext of human verification.

Furthermore, phishing-as-a-Service platforms, which are designed to automate the generation of branded phishing kits by cloning login pages and distributing links have enabled cybercriminals and other cyber threat actors to imitate trusted brands and trick users

It can also be observed that large language models (LLMs) are used to create more convincing phishing emails. By early 2025, AI-supported phishing campaigns reportedly represented more than 80 percent of observed social engineering activity worldwide.

For these reasons, this October, we urge all users to be aware of the variety of phishing and cyber scams that exist including:

• Phishing - email-based phishing
• Quishing - QR code phishing
• Spearphishing -targeted phishing
• Smishing - SMS text phishing
• Vishing - voice-based phishing
• Whaling – top leadership phishing
• BEC – business email compromise scams
• Deep fakes – AI-based scams

The campaign aims to provide up-to-date online security information through awareness raising and the sharing of good practices. Once again, hundreds of activities such as workshops and webinars and online campaigns are ready to take place across Europe to promote digital security and cyber hygiene.

The Cybersecurity Month also intends to serve as an incentive to career development in cybersecurity.

Cybersecurity Awareness as part as the objective to bridge the skills gap

As such the campaign is complementary to the other activities engaged at EU level to promote cybersecurity careers and to develop the workforce needed in the area.

Initiatives serving this purpose include both the European Cybersecurity Challenge (ECSC) and the International Cybersecurity Challenge (ICC). These yearly events allow young talents to compete and showcase their skills.

Cybersecurity challenges are designed to inspire the younger generations to engage in a trendy and highly competitive career for which a wide range of skills are needed. Such demanding competitions test both technical competences such as cryptography, reverse engineering, forensic, web exploitation but also such soft skills as team work, communication, navigating stressful situations and working effectively with people from different backgrounds and nationalities.

#THINKB4UCLICK

The first edition of the European Cybersecurity Month in 2012 gathered momentum over the years with the slogan ‘Cybersecurity is a Shared Responsibility’. The campaign developed by joining efforts with Member States in order to unite against cyber threats. In 2020 ‘Think Before U Click’ became the official motto of the ECSM campaign.

• ENISA topic: European Cybersecurity Month
• ENISA Cybersecurity Month YouTube channel
• ENISA Threat Landscape 2025 | ENISA
• European Cybersecurity Challenge 2025 on 6-10 October in Warsaw, Poland
• International Cybersecurity Challenge 2025 on 11-14 November 2025 in Tokyo, Japan
• Awareness Raising Conference, Zagreb, Croatia on 27 November 2025.