Published: April 6, 2026
Cybersecurity threats don't slow down in the spring - they accelerate. When your team is moving fast through busy season, that's exactly when sophisticated phishing attempts slip through. These aren't obvious scams targeting careless users. They're well-crafted attacks designed to fool experienced employees during normal work.
Here are three active threats we're seeing across client environments right now, plus the specific controls that actually prevent them.
1. Fraudulent Toll and Parking Payment Texts
The Attack:
Employees receive text messages claiming unpaid toll balances - typically $6.99 or similar small amounts. Messages reference legitimate toll systems (E-ZPass, SunPass, FasTrak) and create artificial urgency with 12-hour payment deadlines.
Why It Works:
The amount is small enough to avoid scrutiny. Most people have driven through tolls or paid for parking recently, making the claim plausible. The payment happens in seconds between meetings.
The Scale:
- FBI received 60,000+ complaints about fake toll texts in 2024
- Volume increased 900% in 2025
- Researchers identified 60,000+ fake domains impersonating state toll systems
- Attacks have reached recipients in states without toll roads
Effective Defense:
Establish a company-wide policy: No payments through text message links, period. If an employee receives what appears to be a legitimate payment request, they navigate directly to the official website or app themselves - never through the provided link.
Never reply to these texts, even with "STOP." Responding confirms the number is active and increases future targeting.
2. Fake File-Sharing Notifications
The Attack:
Employees receive emails indicating a document has been shared with them - contracts in DocuSign, spreadsheets in OneDrive, files in Google Drive. The sender name and formatting match legitimate notifications exactly. When employees click and enter credentials to "access" the file, attackers capture their login information.
Why It Works:
These notifications look identical to legitimate file-sharing emails your team receives daily. The newest variants use compromised accounts to create actual files within the platform and trigger real sharing notifications - meaning the email comes from Google's or Microsoft's legitimate servers and bypasses spam filters.
The Scale:
- Phishing campaigns abusing Google Drive, DocuSign, Microsoft, and Salesforce increased 67% in 2025 (KnowBe4 Threat Labs)
- Google Slides-based phishing links spiked over 200% in recent 6-month period
- Employees are 7x more likely to click malicious links from OneDrive/SharePoint than random emails
Effective Defense:
Train employees to verify unexpected file shares through a separate channel before clicking. If a file wasn't anticipated, open the platform directly through your browser rather than clicking the email link. Legitimate files will appear in the platform whether you click the link or not.
IT teams can implement two additional controls in under 15 minutes:
- Restrict external file-sharing permissions
- Enable alerts for unusual login activity or access from new locations
3. AI-Generated Phishing Emails
The Attack:
Phishing emails have evolved beyond obvious grammar errors and formatting issues. AI-generated messages now reference real company names, actual job titles, and specific workflows - all scraped from LinkedIn and company websites. These emails target specific departments: HR receives fake employee verification requests, finance teams get vendor payment redirects.
Why It Works:
The messages are professionally written, contextually relevant, and create appropriate urgency without dramatic language. They look like legitimate Tuesday morning emails.
The Scale:
- AI-generated phishing emails achieved 54% click rate vs. 12% for human-written emails (2025 academic study)
- 72% of employees engaged with vendor impersonation emails in testing
- Vendor impersonation performed 90% better than other phishing types
Effective Defense:
Implement verification protocols for any request involving:
- Credential changes
- Payment information updates
- Sensitive data access
Verification must happen through a second channel - phone call, direct message, or in-person confirmation. Before clicking any link, employees should hover over the sender's email address to verify the actual domain.
Treat urgency itself as a warning sign. Legitimate business requests rarely require immediate action through an unfamiliar link.
The Real Risk Isn't Your Employees
These attacks succeed because they exploit normal work patterns, not employee incompetence. When one rushed click during a busy morning can compromise your business, that's a process issue, not a people problem.
Effective security doesn't rely on perfect decision-making under pressure. It uses systematic controls that make the secure choice the easiest choice.
Security Assessment for Your Business
If you're unsure whether your current security measures address these specific threats, we can evaluate your exposure in a brief consultation:
- Review your current email filtering and authentication controls
- Identify gaps in your file-sharing and external collaboration settings
- Assess your team's verification protocols for sensitive requests
- Recommend specific, actionable improvements based on your environment
Schedule a 30-minute security assessment- https://www.vgcyber.com/discoverycall/
These conversations are straightforward technical evaluations - no sales pressure, just practical recommendations for your specific setup.
