A new report from KnowBe4 reveals a major shift in cybercrime tactics, with spear-phishing rising by 41.1% globally as attackers move away from indiscriminate mass campaigns. In the UAE, organisations face nearly four times the global rate of mobile-focused lures and 2.3 times the average volume of file-based malware. Attackers are increasingly using pre-attack scouting, legitimate cloud and AI infrastructure, and commercial toolkits to bypass traditional authentication defences.
The Phishing Threat Trends Report is based on KnowBe4’s Inbound Email Security data from KnowBe4 Defend, which processes 1.15 billion event signals daily. According to the report, overall phishing volume grew 29.8% year-over-year, with organizations receiving an average of one dangerous email for every 733 emails received. However, the nature of these attacks has changed. Indiscriminate ‘spray and pray’ campaigns saw sharp drops – mobile-focused scams fell 47.3%, 419 (advanced-fee) fraud dropped 31.3%, and missed message lures fell 11.3%. In their place, adversaries are investing heavily in pre-attack research and tailored approaches – spear phishing increased 41.1%, pre-attack scouting increased 33.7%, and company impersonation increased 28%.
Most regions have moved away from file-based payloads, but not the UAE, where malware accounts for 6.7% of dangerous mail, 2.3 times the global average of 2.9%. Attackers are also laying more groundwork, with pre-attack scouting at 4.6% against 2.2% globally. Mobile-focused lures reach 10.0% of dangerous mail, almost four times the global 2.7%, even as this tactic fell 47.3% worldwide. The pattern in the UAE is to research targets first and then deliver a malicious file.
“For years, security advice has focused on a predictable checklist; check the sender address, hover over the link and look for the padlock,” said Jack Chapman, SVP of Threat Intelligence at KnowBe4. “While still foundational, that guidance is becoming less useful by the day. Modern phishing has no need to fool security filters with lookalike domains if attackers can sit directly on trusted ones. Attackers can now borrow legitimate infrastructure, harvest permissions instead of passwords, and react to news headlines at machine speed. Trust signals alone are no longer proof of safety and organizations must rethink where trust belongs as they protect their workforce.”
Key Findings from Phishing Threat Trends Report Vol. 8:
- In Q3 2026, an attack was two times more likely to originate from legitimate infrastructure compared to Q2 2026, with AI platforms as the newest frontier in this trend.
- Threat actors are increasingly hosting fake developer consoles, sign-in prompts, and download hubs directly on native AI platform domains.
- Leveraging generative AI and agentic tools, attackers are now 5.4 times faster at turning breaking news headlines into active phishing lures compared to 2022.
- Commercial toolkits are scaling attacks at volume. Toolkit-driven phishing grew 54% to account for 29.2% of all inbound malicious mail, with just three primary toolkits accounting for 90.2% of all kit-driven phishing.
- Attackers are increasingly bypassing passwords through authentication phishing, device-code logins on platforms like Microsoft Teams, and OAuth consent abuse to hijack sessions and AI agent permissions.
- 90.4% of phishing emails arrive during working days (Monday–Friday), peaking on Monday at 20.6% when inboxes are busiest. Business Email Compromise (BEC) accounts for 51.2% of phish types, with HR, Finance, and Executive Leadership named as the most targeted departments.
