Cybercriminals are shifting from large-scale, untargeted phishing campaigns to targeted attacks on identities. Spear phishing rose by 41.1 per cent in a single year, while mass forms of fraud are declining. The abuse of legitimate cloud and AI platforms and the bypassing of passwords through authentication phishing are also on the rise.
The figures come from the Phishing Threat Trends Report Vol. 8 by security company KnowBe4. The report is based on data from the company’s own Inbound Email Security service, which it says processes 1.15 billion signals a day. KnowBe4 reports that the total number of phishing attacks rose by 29.8 per cent year on year. Globally, an average of one in every 733 inbound emails is malicious. For Dutch organisations, the figure is one in 639.
Less volume, more reconnaissance
According to the report, untargeted ‘spray and pray’ campaigns are declining sharply. Scams aimed at mobile devices fell by 47.3 per cent, advance-fee fraud (also known as 419 fraud) dropped by 31.3 per cent and phishing messages about supposedly missed notifications decreased by 11.3 per cent.
At the same time, attackers are investing more in preparation. Spear phishing grew by 41.1 per cent and reconnaissance of potential targets ahead of an attack rose by 33.7 per cent. The number of cases in which criminals impersonate a legitimate company increased by 28 per cent.
The Netherlands stands out
In the Netherlands, according to KnowBe4, the emphasis is more on technical methods than on psychological manipulation. Technical tricks are used in 50.1 per cent of Dutch phishing attacks, compared with 30.4 per cent globally. Social engineering plays a smaller role there: 19 per cent versus 46.8 per cent globally. Advance-fee fraud is relatively common in the Netherlands, accounting for 12 per cent of attacks, almost three times the global average of 4.7 per cent.
Legitimate infrastructure and AI platforms
The report states that an attack was twice as likely to originate from legitimate IT infrastructure in the third quarter of 2026 as in the second quarter. AI platforms are increasingly being used as an attack vector. Criminals use the official domains of these platforms to host fake development environments, bogus login pages and deceptive download pages. According to the researchers, attackers using generative AI and agentic tools turn news into phishing lures 5.4 times faster than in 2022.
Toolkits and authentication phishing
Phishing via commercial toolkits grew by 54 per cent, according to KnowBe4, and now accounts for 29.2 per cent of all inbound malicious emails. Three toolkits are together responsible for 90.2 per cent of these.
Attackers are also increasingly bypassing passwords through authentication phishing. They use device codes to log in to services such as Microsoft Teams and abuse OAuth consents to hijack the sessions and permissions of AI agents.
Business Email Compromise accounts for 51.2 per cent of phishing types. Of all phishing emails, 90.4 per cent arrive on weekdays, peaking at 20.6 per cent on Mondays. HR, finance and management are the most frequently targeted groups.
Trusted signals less useful
Jack Chapman, SVP of Threat Intelligence at KnowBe4, says that classic advice such as checking the sender’s address, inspecting links and looking for the padlock in the address bar remains a foundation, but is becoming less and less effective. According to Chapman, criminals no longer need to fool filters with spoofed domains when they can abuse trusted services and steal access permissions rather than passwords. He argues that organisations therefore need to reassess what they can trust and how they protect their employees.
The full report is available via Phishing Threat Trends Report Vol. 8.
This article was originally published in Dutch on MSP Business. Read the original →
