Cybercriminals target people, not just systems, Kaspersky warns

Global cybersecurity company Kaspersky said the biggest cyberthreat facing Filipinos in 2025 is not malware, it is manipulation.

“The Philippines has always been a highly connected society, and that connectivity is both a strength and a vulnerability,” said Sam Yan, Head of Sales for Asia Emerging Countries at Kaspersky.

“Cybercriminals know that the fastest way into someone’s account or device is often not through a firewall, but through a convincing message. As long as people can be tricked, human-focused attacks will remain the preferred weapon of choice,” he added.

In 2025, Kaspersky products detected 10.2 million internet-borne cyberthreats targeting users in the Philippines, placing the country 6th worldwide in terms of dangers associated with web browsing. The threat is even greater at the device level, with Kaspersky recording 19.4 million local, on-device threat incidents in the same period, placing the Philippines 67th worldwide in terms of users attacked by on-device threats.

Meanwhile, the Bangko Sentral ng Pilipinas (BSP) reports that human-focused attacks – including account takeover, identity theft, and social engineering – accounted for approximately 76 percent of cyber fraud-related losses in the Philippines in 2025.

“The data underscores that Filipinos are being attacked on two fronts simultaneously, and that they are being tricked into giving up their credentials, while their devices are targeted at the same time. The convergence of these two attack vectors makes the Philippines a particularly high-risk environment for everyday internet users,” Yan further said.

To help Filipinos better protect themselves, Kaspersky recommends the following:

For individuals:

• Always independently verify the identity of anyone asking for personal information, financial details, or login credentials even if the request appears to come from a known institution, a government agency, or a family member.
• Phishing links are increasingly sophisticated and may appear as legitimate websites or shortened URLs. Navigate directly to official websites rather than following links in unsolicited messages.
• Adding a second layer of verification to your accounts, especially banking, email, and social media, significantly reduces the risk of unauthorized access, even if your password is compromised.
• A reliable security solution can help you detect and block phishing attempts, malicious websites, and on-device threats before they cause harm

For Businesses and Organizations

• Human error remains the leading cause of successful cyberattacks. Regular training with the help of a trusted provider helps staff recognize phishing attempts, social engineering tactics, and suspicious activity before they escalate
• Limit employee access to sensitive systems and data on a need-to-know basis, and require multi-factor authentication (MFA) across all critical business accounts and platforms.
• Organizations should be prepared to act quickly when a breach occurs. A clear, tested response plan minimizes damage and reduces recovery time.
• Businesses handling sensitive customer data — particularly those in financial services, retail, and healthcare — should work with cybersecurity experts to assess vulnerabilities and implement layered defenses.