Phishing Threat Trends Report Vol 8 shows a shift towards hyper-targeted attacks, weaponized AI platforms and rapid news hijacking
KnowBe4, the global leader in digital workforce security, securing both humans and AI agents, today announced the release of its Phishing Threat Trends Report, Vol. 8. The report reveals a fundamental shift in cybercrime tactics: mass, low-effort commodity fraud is in steep decline as threat actors focus on hyper-targeted identity attacks, abusing trusted cloud and AI infrastructure, and bypassing traditional authentication defenses.
The Phishing Threat Trends Report is based on KnowBe4’s Inbound Email Security data from KnowBe4 Defend, which processes 1.15 billion event signals daily. According to the report, overall phishing volume grew 29.8% year-over-year, with organizations receiving an average of one dangerous email for every 733 emails received. However, the nature of these attacks has changed. Indiscriminate ‘spray and pray’ campaigns saw sharp drops - mobile-focused scams fell 47.3%, 419 (advanced-fee) fraud dropped 31.3%, and missed message lures fell 11.3%. In their place, adversaries are investing heavily in pre-attack research and tailored approaches - spear phishing increased 41.1%, pre-attack scouting increased 33.7%, and company impersonation increased 28%.
“For years, security advice has focused on a predictable checklist; check the sender address, hover over the link and look for the padlock,” said Jack Chapman, SVP of Threat Intelligence at KnowBe4. “While still foundational, that guidance is becoming less useful by the day. Modern phishing has no need to fool security filters with lookalike domains if attackers can sit directly on trusted ones. Attackers can now borrow legitimate infrastructure, harvest permissions instead of passwords, and react to news headlines at machine speed. Trust signals alone are no longer proof of safety and organizations must rethink where trust belongs as they protect their workforce.”
Key Findings from Phishing Threat Trends Report Vol. 8:
- In Q3 2026, an attack was two times more likely to originate from legitimate infrastructure compared to Q2 2026, with AI platforms as the newest frontier in this trend.
- Threat actors are increasingly hosting fake developer consoles, sign-in prompts, and download hubs directly on native AI platform domains.
- Leveraging generative AI and agentic tools, attackers are now 5.4 times faster at turning breaking news headlines into active phishing lures compared to 2022.
- Commercial toolkits are scaling attacks at volume. Toolkit-driven phishing grew 54% to account for 29.2% of all inbound malicious mail, with just three primary toolkits accounting for 90.2% of all kit-driven phishing.
- Attackers are increasingly bypassing passwords through authentication phishing, device-code logins on platforms like Microsoft Teams, and OAuth consent abuse to hijack sessions and AI agent permissions.
- 90.4% of phishing emails arrive during working days (Monday–Friday), peaking on Monday at 20.6% when inboxes are busiest. Business Email Compromise (BEC) accounts for 51.2% of phish types, with HR, Finance, and Executive Leadership named as the most targeted departments.
Download the full report, here.