Cyber attacks, including cyber social engineering attacks, such as malicious emails, are always evolving with time. Thus, it is important to understand their evolution. In this paper we characterize the evolution of malicious emails through the lens of Psychological Factors (PFs), which are humans’ psychological attributes that can be exploited by malicious emails (i.e., attackers who send them). For this purpose, we propose a methodology and apply it to conduct a case study on 1,260 malicious emails over a span of 21 years (2004–2024). Our findings include: (i) attackers have been constantly seeking to exploit many PFs, especially the ones that reflect human traits; (ii) attackers have been increasingly exploiting 9 PFs and mostly in an implicit or stealthy fashion; (iii) some PFs are often exploited together. These insights shed light on how to design future defenses against malicious emails.