“Is it real?” has become a common question across our digital lives thanks to the rise of AI-generated content.
A fair one, with deepfakes and AI-produced imagery flooding nearly every channel we use daily. A skeptical eye is a must, but our most recent Phishing Threat Trends Report reveals why that might not even be enough.
Our 8th Phishing Threat Trends Report tracks how attackers stopped faking infrastructure and started borrowing it. Modern phishing has no need to fool filters with lookalike domains when it can sit directly on trusted ones. This shift runs through every finding in this report: campaigns are routed through hyperscalers, attackers harvest API keys from trusted platforms, and session hijacking via refresh tokens that render "change your password" meaningless. The only thing left that is fake is the premise.
Overall, phishing volume rose 29.8% in 2026 compared to 2025, and one dangerous email now lands in every 733 an organization receives. The bigger shift is not how much arrives but how it is built. Attackers have stopped faking infrastructure and started borrowing it. Check out Volume 8 of our Phishing Threat Trends Report to see what that looks like and where security teams should focus next.
Download the full report here. Read on for some highlights:
Targeting Sharpens as Mass Phishing Declines
Mass, low-effort phishing is fading. Mobile-focused attacks fell 47.3% and 419 scams fell 31.3% compared to 2025. Meanwhile, lures built on research and personal selection are rising. Spear phishing is up 41.1%, scouting is up 33.7%, and company impersonation is up 28%.
Links remain the dominant payload at 66.2%, including QR codes. Attachments account for 19.1%, and nearly one in three phishing attachments is a PDF.
Attackers Are Stealing Permission, Not Passwords
Authentication phishing goes after the sign-in itself. Instead of capturing a password, attackers use device-code logins and OAuth consent to obtain persistent access. In Q3 2026, authentication phishing accounted for 2% of link-based phishing from toolkits, and 25.6% of link-bearing attacks had MFA-bypass capability.
Because the stolen access is a token or a permission rather than a password, a password reset does not end the compromise. Lures for device-code campaigns are also moving from email to Microsoft Teams, through compromised accounts, fake calendar invites, and missed-voicemail alerts.
AI Platforms Become the Newest Phishing Host
Attackers are increasingly sitting on trusted AI domains rather than spoofing their logos. Attacks impersonating AI brands rose 228% between April and August 2026. In Q3 2026, attacks were twice as likely to originate from legitimate infrastructure than in Q2, and threat actors are using native platform features to host fake developer consoles, sign-in prompts, and download hubs.
The primary goals are credential and API key harvesting, quota fraud, and malware delivered through on-platform app downloads. For organizations, the risk extends beyond people. Stolen API keys and OAuth grants can turn AI agents into attack tools, redirecting their actions and siphoning the data they process.
Secure Email Gateways Miss Many Phish
Email security is catching less than it should. 41.3% of phishing emails bypass secure email gateways, peaking at 48.3% in July 2026. Real domains, valid certificates, and genuine consent screens are now part of the attack, so filters built on lookalike detection fall short. In fact, 58.1% of the phish that gateways miss still pass DMARC.
When the filter misses, the employee becomes the last line of defense. Real-time coaching and continuous training keep that layer working, especially as lures get more personal and more convincing.
What This Means for Security Leaders
The pattern is consistent. Phishing has moved from fake infrastructure to borrowed infrastructure, and from broad campaigns to targeted, automated ones. Trust signals alone are no longer proof of safety.
Standard secure email gateways and native mail filters were built for a threat landscape that no longer exists. As adversaries abuse genuine cloud infrastructure, deploy specialized reverse-proxy toolkits, and hijack trusted AI platforms, perimeter-based defenses simply cannot keep pace with localized, highly targeted attacks. Your security stack needs to be as agile, adaptive, and geographically aware as the threat actors themselves.
By moving toward an integrated platform fueled by deep behavioral analytics and real-time threat intelligence, your security posture shifts from reactive filtering to continuous, automated defense. Delivering real-time behavioral coaching at the exact moment of risk transforms your workforce into an active line of defense, securing both your human workforce and your autonomous AI tooling across every global operation.
Download the full report to see the regional, industry, and toolkit data behind these findings.
