As social engineering tactics become faster, more sophisticated, and harder to detect, staying ahead of cyber threats requires actionable intelligence. This executive summary highlights the core findings and critical takeaways from our comprehensive analysis.
29.8%increase in phishing in 2026 compared to 2025
Global Phish Density1 in 733
(One dangerous email in every 733 emails received)
Monthly Phishing Pressure, 2026
One dangerous email per total emails received · lower is worse
APR: 1 in 647
May: 1 in 679
JUN: 1 in 743
JUL: 1 in 857
AUG: 1 in 840
SEP: 1 in 683
Payload Distribution
Links (inc. QR codes)66.2%
Attachments19.1%
No payload11.8%
Malware2.9%
Nearly1 in 3attachment phish use a PDF
Top 5: Distribution of Attachment Types
30.7%
PDF
18%
HTML & HTM
15.2%
Macro Office & ODF
6.5%
SVG
5.6%
EML
Phishing Type Distribution
BEC51.2%
Social engineering46.8%
Technical obfuscation30.4%
Brand impersonation24.3%
Company impersonation20.3%
Missed message13.1%
Spear phishing4.9%
419 scam4.7%
User impersonation3.6%
Mobile-focused2.7%
Scouting2.2%
*Not mutually exclusive so will sum over 100%
How Cybercriminals Are Using Reality Against Us
Everything about the attacks is now real. The login page is real. The consent screen is real. The AI platform hosting the lure is real, and so is the headline it’s built on.
For years, security advice relied on a predictable checklist: check the sender address, hover over the link and look for the padlock. While still foundational, that guidance is becoming less useful by the day. Today, a lawyer signs in on her firm’s genuine login page, an employee enters a code at “microsoft.com” and a developer pastes an API key into an authentic AI platform. In each case, the user verified what we taught them to check, and in each case, the infrastructure was legitimate.
Our 8th Phishing Threat Trends Report tracks how attackers stopped faking infrastructure and started borrowing it. Modern phishing has no need to fool filters with lookalike domains when it can sit directly on trusted ones. This shift runs through every finding in this report: campaigns routed through hyperscalers, API key harvesting on trusted platforms, and session hijacking via refresh tokens that render “change your password” meaningless. The only thing left that is fake is the premise.
Accelerating this transformation is the speed of weaponization and the democratization of cybercrime. We follow this transformation through the year’s most critical themes. From turning breaking news into immediate lures to abusing AI brands and agentic infrastructure, attackers are redefining the playbook. We break down how rented toolkits created a full-fledged phishing supply chain, why authentication-centric attacks make password resets meaningless and how these evolving threats bypass traditional defenses across distinct regions and sectors.
The message is clear: trust signals alone are no longer proof of safety. We hope these insights help you rethink where trust belongs as you protect your organization and its people.
Unless otherwise stated, all statistics have been generated from KnowBe4 Defend. As always, please reach out if you have any questions or want to learn more about how KnowBe4 stops these threats.
- Jack Chapman - SVP of Threat Intelligence, KnowBe4
Geographic Threat Telemetry
How Adversaries Adapt Across Borders
Threat actors do not run one-size-fits-all global campaigns. While phishing is often treated as a uniform threat, regional threat telemetry reveals a localized landscape where attackers tailor their tactics to exploit specific geographic vulnerabilities and communication norms.
A threat in Zurich looks nothing like one in Dubai or Dublin. Security posture cannot rely solely on global baselines. The following analysis breaks down the country-specific telemetry across each key region, detailing how adversary tactics shift to exploit local vulnerabilities.
Spain
High-Effort Delivery, Low-Effort Story
Missed-message lures (voicemails, held deliveries, waiting documents) make up 27% of malicious email in Spain. This is more than double the global average of 13.1% and the highest share of any market. Technical lures dominate alongside these campaigns at 56.6% (vs. 30.4% globally), relying on obfuscation and redirection to do the heavy lifting. Conversely, social engineering (17.5% vs. 46.8% globally) and spear phishing (2.4% vs. 4.9% globally) are largely absent. Attackers aren’t trying to persuade Spanish targets; they are optimizing for technical delivery.
Czech Republic
Crude, Burner-DomainVolume
The Czech Republic faces the most high-volume, unpolished attacks of any market, experiencing 2.2 times the per-mailbox attack rate of the global average. Attackers rely on disposable infrastructure—the average malicious sending domain is just 2.5 years old compared to 14.3 years globally. Messages are stripped down to absolute basics: 96.7% contain a bare link, and at an average of just 350 characters, they are the shortest emails in the dataset.
South Africa
Exploiting Internal Trust and Weak SPF
Attackers target South African organizations through direct brand deception. Company impersonation appears on 64.1% of dangerous mail—nearly two thirds of all attacks and triple the global rate (20.3%). Threat actors exploit systemic infrastructure gaps to land these emails, backed by South Africa recording the weakest SPF authentication compliance of any rated market at just 33.2%.
Switzerland
Visual Internal Spoofs
Swiss targets face highly visual, internal-facing impersonations designed for quick execution. Messages average 9.8 images per email (compared to 2.6 globally) and run short at 747 characters. One-third of attacks (33.2% vs. 20.3% globally) impersonate the recipient’s own organization. Rather than long persuasions, attackers drop hyper-visual, low-text notifications that mimic internal corporate tools.
Netherlands
Technical Infrastructure and Fraud Over Persuasion
Organizations in the Netherlands experience 1 phish every 639 emails, with a heavy reliance on technical delivery rather than psychological persuasion. Technical lures dominate at 50.1% (versus 30.4% globally), while social engineering plummets to just 19% (versus 46.8% globally). The region also faces a disproportionate volume of 419 scams at 12%—nearly triple the global baseline of 4.7%. Adversaries skip complex narrative lures to focus on technical delivery and legacy financial scams.
Ireland
Bypassing the Brand to Target the Person
In Ireland, attackers swap organizational spoofing for interpersonal trust. Colleague impersonation drives 12.7% of dangerous mail—more than triple the global average (3.6%)—while company impersonation drops to just 9%. Supported by an elevated spear-phishing rate of 8% (vs. 4.9% globally), adversaries consistently exploit personal workplace relationships over corporate logos.
United Arab Emirates
File Payloads and Heavy Reconnaissance
While most regions have abandoned file-based payloads, malware thrives in the UAE at 6.7% of dangerous mail—more than double the global baseline (2.9%). Attackers lay the groundwork through visible pre-attack activity, with scouting probes running at 4.6% (vs. 2.2% globally) and mobile-focused lures hitting 10% (vs. 2.7% globally), before delivering the execution file.
France
Built for the Mobile Screen
France is the single largest outlier for mobile-targeted attacks. Mobile-focused lures account for 12.8% of dangerous mail—nearly five times the global average (2.7%). Combined with an 11% spear-phishing rate (vs. 4.9% globally), adversaries tailor their lures specifically for mobile viewports, exploiting lower visibility on handheld screens to trick high-value targets.
Singapore
Legacy Scams Meet User Impersonation
Singapore presents a unique dual threat profile. Advance-fee (419) fraud accounts for 24.4% of dangerous mail—5.2 times the global average (4.7%)—making legacy financial scams a uniquely Singaporean issue. Alongside this, colleague impersonation reaches 15.9%, the highest rate recorded in any market globally.
United Kingdom
High Link Dependence and Rising Corporate Abuse
The UK remains heavily link-dependent, with malicious URLs powering 74.1% of dangerous mail against a 66.2% global baseline—the second-highest rate among rated markets. Compounding this, company impersonation surged from 10% to 17.3% over six months. Attackers rely on familiar corporate branding to build immediate credibility once the target clicks through to the spoofed login page.
United States
Trusted Logos Over Personal Identity
U.S. targets are overwhelmingly primed through brand familiarity rather than personal connections. Brand impersonation accounts for 28.4% of dangerous mail. Supported by high social engineering rates (50.4% vs. 46.8% globally), the attack almost always arrives as a familiar login screen rather than a known colleague.
Germany
Absolute BEC Dominance
Business Email Compromise (BEC) completely dominates here, driving 79.2% of attacks in Germany (vs. 51.2% globally). This laser focus crowds out almost all other attack vectors; standard brand impersonation drops to a negligible 5.9% in Germany.
Japan
Engineered Evasion Over Easy Bait
Japan faces engineered attacks rather than obvious lures. Technical evasions (spoofed headers, obfuscated links, and custom encoding) built directly into message architecture account for 34.9% of Japanese dangerous mail (vs. 30.4% globally). Payloads reflect this technical focus: malicious links drop to 52.4% (vs. 66.2% overall, the second-lowest in the dataset), while file-based malware doubles the global baseline at 5.8%.
Key Findings and Analysis
This section analyzes the key operational and tactical shifts in the 2026 phishing landscape. Threat actors are leveraging generative AI to react to news headlines at machine speed, while the industrialization of commercial toolkits enables widespread, high-volume credential theft.
Beyond traditional phishing, adversaries are increasingly skipping passwords entirely by exploiting device-code logins and OAuth permissions, alongside hosting malicious infrastructure directly on trusted AI platforms to bypass security gateways.
How Attackers Turn Headlines Into Phishing Attacks
7.5xfaster
Threat actors react to breaking news roughly 7.5 times faster than to events scheduled months in advance.
Breaking News: So far in 2026, attackers are 5.4 times faster when responding to headlines than they were in 2022. This acceleration aligns with the 2024 boom in artificial intelligence, where the rapid evolution and maturing of AI agents continues to pay them dividends.
All the News That’s Fit to Spoof: In 2026, the average attack duration for campaigns leveraging planned media coverage surged by 138% compared to 2025. Attackers are deploying higher volume, longer running campaigns designed to maximize their reach and successfully capture more credentials.
Ripped from the Headlines: While breaking news attacks move fast and resolve quickly, ending 4.8 times quicker in 2026 than campaigns built around planned coverage, scheduled events offer attackers a longer runway. The lifespan of planned coverage campaigns has doubled from 2022 to 2026, allowing attackers to rotate through multiple themes and angles of approach.
The Phishing Economy: How Toolkits and Trade Routes Scale Cybercrime
Opening the Toolbox: By Q3 2026, toolkit-based phishing accounted for 29.2% of malicious emails processed by KnowBe4 Defend; a 54% increase from 18.9% in 2024.
Cornering the Market: Just three primary toolkits account for a staggering 90.2% of all kit-driven phishing.
Phishing Made Automatic: Single-burst attacks (disposable, one-off domain setups) represent 20.7% of tracked operations but yield just 2.2% of total email volume. Conversely, automatically executed phishing campaigns based on rented toolkits represent 43.1% of operations and drive 91.3% of all toolkit-driven phish.
Act Locally, Phish Globally: Modern phishing has evolved to function like global logistics: developers build toolkits, payloads are routed regionally and localized lures execute the final compromise.
Just three primary toolkits account for a staggering 90.2% of all kit-driven phishing:
Sneaky 2FA:
41.4%
FlowerStorm:
32.6%
ONYX Store:
16.2%
Attackers Are Now Stealing Permissions, Not Just Passwords
Skipping the Password: In Q3 2026, authentication phishing (compromising a one-time security code to steal user authentication information), accounted for 2% of all link-based phishing attacks originating from phishing toolkits.
Moving Beyond the Inbox: Lure delivery for device code campaigns has shifted from classic email to threat actors pivoting heavily to Microsoft Teams. They drop user_codes and setup steps through compromised accounts, fake calendar invites, or missed-voicemail alerts.
OAuth and AI: OAuth consent phishing (taking advantage of a widely used method for granting third-party applications access to user data without sharing user credentials) takes the routine prompt users see authorizing third-party applications and turns it into an attack vector. Applying this tactic to AI agentic platforms, attackers could use the stolen permissions to redirect the agent’s actions, siphon the data it processes, and abuse the trust that AI already holds across the network.
Four Shared Traits of Authentication Phishing
1Real infrastructure
2Zero password stealing
3Immunity to reset
4Weaponizing security habits
Actors Weaponize AI Brands and Hijack Agentic Infrastructure
228%surge
in AI-brand impersonation attacks between April and August 2026.
The AI Misdirect: In Q3 2026, an attack was two times more likely to originate from legitimate infrastructure compared to Q2 2026, with the newest frontier in this trend being AI platforms.
Bypassing the Security Guard: Instead of merely spoofing an AI logo in an email, threat actors are abusing native platform features and usergenerated content spaces, like “claude[.]ai” or “chatgpt[.]com,” to host fake developer consoles, sign-in prompts and download hubs on real AI domains.
Primary Attack Plays: Once hosted on the AI platform, threat actors typically execute credential/API key harvesting, on-platform re-authentication and quota fraud, and/or on-platform app download and malware attacks as their main attack methods.
Frequently Asked Questions
Phishing volume rose 29.8% in 2026 in part because attackers have industrialized the attack itself, not because defenses have gotten worse. A commercial toolkit market now lets any attacker rent access to sophisticated techniques, including MFA-bypass capability, that once required real technical skill. Traditional secure email gateways still rely on detection methods built for a threat landscape that no longer matches how these rented, always-on toolkits operate. KnowBe4 data shows 41.3% of phishing now bypasses SEGs outright.
Authentication phishing is an attack where threat actors trick users into granting access through legitimate sign-in systems, rather than stealing a password to begin with. Because no credential is ever harvested, resetting a password does nothing to remove the attacker's access. Two mechanisms drive this: device-code abuse, where a victim unknowingly authorizes an attacker's session on a genuine login page, and OAuth consent-grant phishing, where a victim accepts permissions for an attacker-controlled application. Both issue tokens that can persist for 90+ days and require manual, admin-level revocation to remove.
Effective AI agent security requires monitoring for anomalous behavior and enforcing conditional access on the permissions granted to agents, not just scanning for malicious links. As enterprises adopt autonomous AI tools, stolen API keys and OAuth grants tied to an agent give attackers the same operational control as compromising the model itself — no prompt injection required. KnowBe4's Threat Intelligence team recommends continuous API key rotation, strict conditional access policies for agentic frameworks, and behavioral monitoring for background platform traffic as baseline controls.
Yes — threat actors have been observed abusing native features on legitimate AI platforms to host fake login pages, developer consoles, and credential harvesters on the platform's own trusted domain. Because the domain is genuine and the TLS certificate is valid, both automated security filters and cautious users checking the address bar see no red flags. KnowBe4 telemetry recorded this tactic alongside a 228% surge in AI-brand impersonation attacks between March and August 2026.
Secure email gateways miss a significant share of phishing because they were built to filter perimeter-level threats, not the behavioral and infrastructure-level tactics attackers now use. KnowBe4 data shows SEGs miss 41.3% of dangerous phishing, and more than half of what gets through is business email compromise that passes DMARC authentication. Integrated cloud email security (ICES) platforms are designed to close this gap by layering AI-powered behavioral detection on top of, or in place of, a traditional gateway.
Sneaky 2FA is the most widely used phishing toolkit for bypassing multi-factor authentication, responsible for 41.4% of all attributed kit-driven phishing attacks tracked by KnowBe4 in Q3 2026. It operates as a reverse-proxy adversary-in-the-middle (AiTM) kit, sitting between the victim and the legitimate authentication server to intercept live session cookies. Alongside FlowerStorm (32.6%) and ONNX Store (16.2%), these three toolkits account for 90.2% of all kit-driven phishing volume.
See KnowBe4 Defend™ in Action
Learn how Defend strategically enhances Google Workspace and Microsoft 365 native security to catch the threats Secure Email Gateways (SEGs) and other ICES solutions miss.
