Your team comes back from vacation. The attackers never left. Researchers at ProofPoint and Check Point both report a jump in phishing through the summer months. Here's why it happens and what keeps your Macs and your business data out of it.
The summer calendar gives scammers their cover
When people are booking trips, attackers build fake hotel and Airbnb sites to catch them. Check Point Research counted a 55% rise in vacation-related domain registrations in May 2025 over the year before. That's more than 39,000 new domains, and one in 21 was flagged as malicious or suspicious.
Late summer brings the next wave. Back-to-school campaigns impersonate university emails aimed at students and staff. You might think your business is clear of that, but it isn't. An employee checking a personal inbox on a work Mac can hand an attacker a way into your network.
What actually protects your Macs
AI cuts both ways. It sharpens defenses, and it also writes cleaner scam emails. So the old advice about spotting typos no longer holds. A trained team that knows what to look for is still the thing that stops the click. Here's what to drill on.
- Read the sender, not the grammar. Spelling and grammar won't give a scam away anymore. Check the actual sender address and hover over every link to see where it really goes before you click.
- Look hard at the URL. Watch for misspelled domains and odd endings like .today or .info, which show up often on scam sites.
- Go to the site yourself. Don't click the link in the email. Type the address into your browser so a redirect can't send you somewhere else.
- Turn on multifactor authentication. MFA means a stolen password isn't enough on its own. Even after a breach, an attacker still can't get into the account.
- Treat public WiFi as hostile. If you have to use it, run a VPN before you touch a booking portal, bank, or anything else sensitive.
- Keep personal accounts off work devices. Personal email and social media don't belong on a company Mac. That one boundary cuts a lot of your exposure.
- Ask your MSP about endpoint protection. Endpoint Detection and Response (EDR) watches your Macs and mobile devices, blocks phishing attempts, and alerts your MSP the moment something looks wrong.
Phishing keeps getting better as the tools behind it get better. None of these steps is hard. Run them as habits, keep your team current on what the scams look like, and the summer spike mostly passes you by.