Report: Cyber Criminals Move Toward More Targeted Phishing Attacks
Cyber criminals are moving away from mass phishing scams and focusing on more targeted attacks, increasingly using trusted websites and services to trick victims, according to a new report from KnowBe4. The security firm found that spear-phishing attacks increased 41% over the past year.
The company's Phishing Threat Trends Report, Vol. 8 found that overall phishing volume increased 29.8% year over year. Organizations received an average of one dangerous e-mail for every 733 messages, but the bigger concern is how attackers are changing their approach.
Rather than sending the same fraudulent message to thousands of people, criminals are spending more time researching their targets and creating convincing messages that appear to come from trusted coworkers, businesses, and technology platforms.
The findings are based on threat data from KnowBe4 Defend, the company's inbound e-mail security platform, which processes approximately 1.15 billion event signals daily.
KnowBe4 found that several traditional phishing methods declined significantly compared with 2025. Mobile-focused scams dropped 47.3%, advance-fee fraud fell 31.3%, and missed-message scams declined 11.3%.
Meanwhile, spear phishing increased 41.1%, pre-attack reconnaissance rose 33.7%, and company impersonation climbed 28%.
The shift suggests that attackers are finding more value in carefully crafted scams that exploit existing business relationships and workplace routines.
Business e-mail compromise (BEC) remains particularly common, accounting for 51.2% of phishing e-mails analyzed in the report. Human resources, finance departments, and executive leadership are among the most frequently targeted groups.
Attackers also appear to be timing their campaigns around normal business activity. KnowBe4 found that 90.4% of phishing messages arrive Monday through Friday, with Monday accounting for the largest share at 20.6%.
One of the report's more troubling findings involves the growing use of legitimate technology platforms to deliver malicious content.
KnowBe4 found that phishing attacks were twice as likely to originate from legitimate infrastructure in the third quarter of 2026 compared with the previous quarter.
That includes AI services, where attackers are taking advantage of trusted domains to host fake developer consoles, login prompts, and credential-stealing pages. The report also identified a 228% increase in AI-brand impersonation attacks between March and August.
Because these malicious pages can operate on legitimate domains with valid security certificates, users may not see the usual warning signs associated with suspicious websites.
"For years, security advice has focused on a predictable checklist: Check the sender address, hover over the link, and look for the padlock," said Jack Chapman, senior vice president of threat intelligence at KnowBe4.
"While still foundational, that guidance is becoming less useful by the day."
The findings echo a recent report about management software and AI e-mail assistants. Research from Fortra and Barracuda showed how criminals are using legitimate administrative tools and hidden AI instructions to manipulate users and compromise systems.
KnowBe4 also warned that attackers are increasingly interested in stealing access permissions rather than passwords.
These attacks exploit legitimate authentication processes, including device-code sign-ins and OAuth consent requests. An employee might unknowingly authorize an attacker-controlled session or grant a harmful app access to corporate resources.
Because the attacker receives authentication tokens or application permissions, simply resetting a compromised password may not be enough to cut off access.
This activity is particularly relevant to Microsoft environments.
An October report from Ontinue found that approximately 30% of monitored organizations experienced attempts to impersonate IT support through Microsoft Teams during the first half of 2026. Researchers also documented device-code phishing compromises involving Microsoft accounts.
KnowBe4's findings show how attackers are finding new ways to take advantage of trusted login systems instead of trying to break through traditional security defenses.
AI is also helping criminals move faster, particularly when it comes to using breaking news to trick people. KnowBe4 found that attackers can now turn major news stories into phishing campaigns 5.4 times faster than they could in 2022. Generative AI tools make it easier to quickly create convincing messages that take advantage of current events.
Ready-made phishing toolkits are also making attacks easier to carry out. These tools accounted for 29.2% of malicious e-mails in the third quarter, up from 18.9% in 2024.
Just three toolkits — Sneaky 2FA, FlowerStorm, and ONNX Store — were responsible for 90.2% of all toolkit-based phishing attacks.
Many of these messages are also getting past traditional e-mail security tools. KnowBe4 found that 41.3% of dangerous phishing e-mails made it through secure e-mail gateways.
To address these threats, KnowBe4 recommends that organizations pay closer attention to suspicious login activity, tighten controls over OAuth permissions, regularly rotate API keys, and monitor how AI agents access enterprise systems.
For the full report, visit the KnowBe4 site.