Global phishing volume rose 29.8 per cent year-on-year in 2026, but the nature of what lands in inboxes has shifted. Indiscriminate bulk campaigns are declining. What has taken their place is more labour-intensive and considerably harder to spot.
That is the central finding of KnowBe4’s Phishing Threat Trends Report, Vol. 8, drawn from 1.15 billion daily event signals processed through its inbound email security platform.
While overall attack volumes climbed, mobile-focused scams fell 47.3 per cent, 419 advance-fee fraud dropped 31.3 per cent, and missed-message lures were down 11.3 per cent. In their place, spear phishing grew 41.1 per cent, pre-attack scouting increased 33.7 per cent, and company impersonation rose 28 per cent.
“For years, security advice has focused on a predictable checklist; check the sender address, hover over the link and look for the padlock. While still foundational, that guidance is becoming less useful by the day. Modern phishing has no need to fool security filters with lookalike domains if attackers can sit directly on trusted ones. Attackers can now borrow legitimate infrastructure, harvest permissions instead of passwords, and react to news headlines at machine speed. Trust signals alone are no longer proof of safety and organizations must rethink where trust belongs as they protect their workforce,” Jack Chapman, SVP of Threat Intelligence at KnowBe4 said in a statement.
The pattern in the UAE diverges from the global picture. File-based malware accounts for 6.7 per cent of dangerous mail locally, 2.3 times the global average of 2.9 per cent.
Mobile-focused lures reach 10 per cent of dangerous mail, nearly four times the global rate of 2.7 per cent, even as that tactic collapsed elsewhere. Pre-attack reconnaissance sits at 4.6 per cent against a global 2.2 per cent. Attackers in the UAE, the report suggests, are researching targets first and then delivering a malicious file, a combination that other markets have largely moved past.
Broader structural shifts are also apparent. In Q3 2026, an attack was twice as likely to originate from legitimate infrastructure than in Q2, with AI platforms emerging as the newest hosting ground for fake developer consoles, sign-in prompts, and download hubs.
Attackers using generative AI are now 5.4 times faster at converting breaking news into active phishing lures than they were in 2022. Commercial toolkits are scaling the problem: toolkit-driven phishing grew 54 per cent to account for 29.2 per cent of all inbound malicious mail, with three toolkits responsible for 90.2 per cent of kit-driven attacks.
Authentication is also under pressure. Attackers are bypassing passwords through device-code login abuse on platforms including Microsoft Teams and through OAuth consent requests that hijack session and AI agent permissions, rather than stealing credentials directly.
Business Email Compromise accounts for 51.2 per cent of phish types, with HR, Finance, and Executive Leadership the most targeted departments. Nearly all phishing emails, 90.4 per cent, arrive on working days, with Monday accounting for 20.6% of weekly volume.
