KnowBe4, the global leader in digital workforce security, securing both humans and AI agents, today announced the release of its Phishing Threat Trends Report, Vol. 8. The report reveals a fundamental shift in cybercrime tactics: mass, low-effort commodity fraud is in steep decline as threat actors focus on hyper-targeted identity attacks, abusing trusted cloud and AI infrastructure, and bypassing traditional authentication defences.

The Phishing Threat Trends Report is based on KnowBe4’s Inbound Email Security data from KnowBe4 Defend, which processes 1.15 billion event signals daily. According to the report, overall phishing volume grew 30% year-over-year, with organisations receiving an average of one dangerous email for every 733 emails received. However, the nature of these attacks has changed.

Indiscriminate ‘spray and pray’ campaigns saw sharp drops – mobile-focused scams fell 47%, 419 (advanced-fee) fraud dropped 31%, and missed message lures fell 11%. In their place, adversaries are investing heavily in pre-attack research and tailored approaches – spear phishing increased 41%, pre-attack scouting increased 34%, and company impersonation increased by 28%. While these trends are being seen globally, the report also reveals distinct phishing tactics targeting organisations across the UK and Ireland.

In the UK, attacks remain heavily link-dependent, with malicious URLs powering 74% of dangerous mail against a 66% global baseline—the second-highest rate among markets. Adding to this growing threat, company impersonation rose sharply from 10% to 17% over six months. This is where attackers exploit familiar corporate branding to establish trust and create a false sense of legitimacy, making spoofed login pages appear more credible to unsuspecting users.

In contrast, attackers in Ireland swapped organisational spoofing for interpersonal trust. Colleague impersonation drove 13% of dangerous mail—more than triple the global average (4%)—while company impersonation dropped to just 9%. Supported by an elevated spear-phishing rate of 8% (vs. 5% globally), adversaries consistently exploited personal workplace relationships over corporate logos.

“For years, security advice has focused on a predictable checklist; check the sender address, hover over the link and look for the padlock,” said Jack Chapman, SVP of Threat Intelligence at KnowBe4. “While still foundational, that guidance is becoming less useful by the day. Modern phishing has no need to fool security filters with lookalike domains if attackers can sit directly on trusted ones. Attackers can now borrow legitimate infrastructure, harvest permissions instead of passwords, and react to news headlines at machine speed. Trust signals alone are no longer proof of safety and organisations must rethink where trust belongs as they protect their workforce.”

Key Findings from Phishing Threat Trends Report Vol. 8:

• In Q3 2026, an attack was two times more likely to originate from legitimate infrastructure compared to Q2 2026, with AI platforms as the newest frontier in this trend.
• Threat actors are increasingly hosting fake developer consoles, sign-in prompts, and download hubs directly on native AI platform domains.
• Leveraging generative AI and agentic tools, attackers are now 5 times faster at turning breaking news headlines into active phishing lures compared to 2022.
• Commercial toolkits are scaling attacks at volume. Toolkit-driven phishing grew 54% to account for 29% of all inbound malicious mail, with just three primary toolkits accounting for 90% of all kit-driven phishing.
• Attackers are increasingly bypassing passwords through authentication phishing, device-code logins on platforms like Microsoft Teams, and OAuth consent abuse to hijack sessions and AI agent permissions.
• 90% of phishing emails arrive during working days (Monday–Friday), peaking on Monday at 21% when inboxes are busiest. Business Email Compromise (BEC) accounts for 51% of phish types, with HR, Finance, and Executive Leadership named as the most targeted departments.

Download the full report, here