Skip to content
Search
Support
 Select language
Cancel

2026 Phishing Threat Trends Report, Vol. 8

See How Cybercriminals Are Using Reality Against Us

PPTR-vol8_Resource_Dropdown_270x270In Volume 8 of the Phishing Threat Trends Report, we see how attackers are using real platforms, login pages and even AI tools to launch their campaigns.

Threat actors are bypassing MFA entirely through abuse of trusted platforms, while large language models such as Claude and ChatGPT are being turned into phishing hosts on their own trusted domains. Traditional secure email gateways are missing more than 4 in 10 of these attacks.

Plus, we explore how the phishing economy has industrialized in 2026 and dive into the trends in hijacking breaking news stories to send hyper-targeted phishing attacks.

Download now to discover:

  • How a rented "phishing-as-a-service" economy now drives the majority of credential-theft attacks and which three toolkits make up 90.2% of all kit-based phishing
  • Why password resets and MFA re-enrollment no longer stop attackers who've moved to device-code and OAuth consent abuse instead of credential theft
  • What’s driving a 5.4-times increase in cybercriminal newsjacking since 2022 and how a less-than-16-hour turnaround from headline to lure is possible
  • How threat actors are hosting fake login pages and API-key harvesters directly on trusted AI platforms — and why traditional filters can't catch it
  • How 41%of phishing emails are getting past SEGs

Download this report today!

Get the Report!

Frequently Asked Questions

Phishing volume rose 29.8% in 2026 because attackers have industrialized the attack itself, not because defenses have gotten worse. A commercial toolkit market now lets any attacker rent access to sophisticated techniques, including MFA-bypass capability, that once required real technical skill. Traditional secure email gateways still rely on detection methods built for a threat landscape that no longer matches how these rented, always-on toolkits operate. KnowBe4 data shows 41.3% of phishing now bypasses SEGs outright.
Authentication phishing is an attack where threat actors trick users into granting access through legitimate sign-in systems, rather than stealing a password to begin with. Because no credential is ever harvested, resetting a password does nothing to remove the attacker's access. Two mechanisms drive this: device-code abuse, where a victim unknowingly authorizes an attacker's session on a genuine login page, and OAuth consent-grant phishing, where a victim accepts permissions for an attacker-controlled application. Both issue tokens that can persist for 90+ days and require manual, admin-level revocation to remove.
Effective AI agent security requires monitoring for anomalous behavior and enforcing conditional access on the permissions granted to agents, not just scanning for malicious links. As enterprises adopt autonomous AI tools, stolen API keys and OAuth grants tied to an agent give attackers the same operational control as compromising the model itself — no prompt injection required. KnowBe4's Threat Intelligence team recommends continuous API key rotation, strict conditional access policies for agentic frameworks, and behavioral monitoring for background platform traffic as baseline controls.
Yes — threat actors have been observed abusing native features on legitimate AI platforms to host fake login pages, developer consoles, and credential harvesters on the platform's own trusted domain. Because the domain is genuine and the TLS certificate is valid, both automated security filters and cautious users checking the address bar see no red flags. KnowBe4 telemetry recorded this tactic alongside a 228% surge in AI-brand impersonation attacks between March and August 2026.
Secure email gateways miss a significant share of phishing because they were built to filter perimeter-level threats, not the behavioral and infrastructure-level tactics attackers now use. KnowBe4 data shows SEGs miss 41.3% of dangerous phishing, and more than half of what gets through is business email compromise that passes DMARC authentication. Integrated cloud email security (ICES) platforms are designed to close this gap by layering AI-powered behavioral detection on top of, or in place of, a traditional gateway.
Sneaky 2FA is the most widely used phishing toolkit for bypassing multi-factor authentication, responsible for 41.4% of all attributed kit-driven phishing attacks tracked by KnowBe4 in Q3 2026. It operates as a reverse-proxy adversary-in-the-middle (AiTM) kit, sitting between the victim and the legitimate authentication server to intercept live session cookies. Alongside FlowerStorm (32.6%) and ONNX Store (16.2%), these three toolkits account for 90.2% of all kit-driven phishing volume.