Why Cybercriminals Adapt Their Campaigns to the Season

Phishing attacks are most successful when they appear relevant to their targets.

Rather than sending generic messages, attackers increasingly tailor their campaigns around current events, trends, or seasonal activities. Summer provides an ideal opportunity because many people are expecting emails related to travel bookings, package deliveries, or account notifications.

A flight confirmation, a hotel reservation update, or a delivery tracking alert can easily appear legitimate when they match activities that recipients are already engaged in. This familiarity helps phishing emails bypass the natural scepticism that users might otherwise have.

Travel-Themed Phishing Attacks

Travel-related phishing campaigns are among the most common seasonal scams.

Attackers frequently impersonate airlines, travel agencies, accommodation platforms, and car rental companies. Their messages often claim that there is an issue requiring immediate attention, such as a payment problem, booking confirmation, schedule change, or refund request.

The objective is usually to direct victims to a fraudulent website designed to capture login credentials or payment details.

These fake websites often mimic legitimate travel providers with remarkable accuracy. Logos, branding, and page layouts can be copied so effectively that victims may struggle to distinguish them from genuine services.

For employees travelling on business, these attacks can pose an additional risk. A compromised corporate account may provide attackers with access to organisational systems, sensitive communications, or cloud-based services.

Delivery Notifications That Never Existed

Online shopping remains popular throughout the summer, particularly during seasonal promotions and holiday periods.

Cybercriminals take advantage of this behaviour by sending fake delivery notifications that appear to come from courier services or logistics providers. These messages commonly claim that:

• A package is waiting for delivery
• Shipping details must be updated
• Customs charges need to be paid
• A delivery attempt was unsuccessful
• Tracking information requires verification

The urgency created by these messages encourages recipients to act quickly without carefully verifying the source. In reality, the links often lead to credential harvesting websites or malware downloads designed to compromise devices and accounts.

For organisations, a single compromised employee account can become an entry point for broader attacks.

The Rise of Account Alert Scams

Another recurring tactic involves fake security notifications.

These phishing emails are designed to create concern by informing recipients that their accounts may have been compromised. Messages frequently reference suspicious login attempts, password expiry, account suspension, or unusual activity.

Because security alerts naturally require attention, recipients may be more inclined to respond immediately. Attackers exploit this urgency by directing users to fake login pages where credentials can be collected and later abused.

As organisations increasingly rely on cloud-based services and remote access platforms, account alert scams continue to represent a significant threat.

What Makes These Campaigns So Effective?

Although travel scams, delivery notifications, and account alerts may appear different on the surface, they share several common characteristics.

First, they exploit trust. Attackers impersonate brands and services that people recognise and use regularly.

Second, they create urgency. Whether it is a cancelled booking, a missed package, or a potentially compromised account, victims are encouraged to act before taking time to verify the message.

Third, they take advantage of distraction. During holiday periods, people may be travelling, working remotely, or balancing personal and professional responsibilities. This increases the likelihood of mistakes.

Together, these factors help explain why seasonal phishing campaigns continue to achieve success year after year.

Why Awareness Alone Is Not Enough

User awareness remains an important defence against phishing, but modern campaigns are becoming increasingly sophisticated.

Attackers constantly register new domains, create convincing websites, and launch phishing infrastructure that can remain active for only a short period before being replaced.

As a result, organisations need more than awareness training alone. They also require visibility into emerging threats and the ability to identify malicious indicators before they reach potential victims. This is where threat intelligence plays an important role.

Strengthening Detection Through Shared Threat Intelligence

Phishing campaigns rarely target a single organisation.

The same malicious domains, URLs, and infrastructures are often reused across multiple countries, sectors, and victim groups. Information discovered by one organisation may therefore help protect many others.

Threat intelligence sharing enables organisations to identify phishing activity earlier, understand attacker behaviour, and improve detection capabilities. As shown in Figure 1, indicators such as malicious domains, phishing URLs, and compromised credentials can be connected and shared across a broader threat intelligence ecosystem, helping organisations detect and respond to phishing campaigns more effectively.

The ThreatChase project contributes to this effort by supporting the identification and sharing of phishing-related threat intelligence. Through services focused on malicious URLs, phishing domains, and compromised credentials, ThreatChase aims to improve organisations' ability to detect, analyse, and respond to phishing threats.

By promoting collaboration and actionable intelligence, the project helps strengthen resilience against increasingly sophisticated phishing campaigns.

Staying Alert During the Summer Season

Summer phishing campaigns succeed because they exploit situations that people expect to encounter.

A travel confirmation, a delivery notification, or an account security alert may not immediately appear suspicious. However, these familiar scenarios provide an effective disguise for malicious activity.

Taking a moment to verify unexpected messages, checking links before clicking, and relying on trusted sources for threat intelligence can significantly reduce the risk of compromise.

As cybercriminals continue to adapt their tactics to seasonal behaviours, organisations must remain equally adaptable. Combining awareness, vigilance, and intelligence sharing remains one of the most effective ways to stay protected against phishing threats throughout the summer and beyond.

Explore more insights in the ThreatChase project blog, including our guide to phishing protection for SMEs and our analysis of why sharing phishing intelligence matters.