KnowBe4 released the eighth volume of its Phishing Threat Trends Report on 29 October 2026, and the headline finding is a shift every email defender should internalize: cybercriminals are abandoning mass, low effort fraud and investing instead in hyper targeted attacks. Spear phishing increased 41.1% year over year, pre attack scouting rose 33.7% and company impersonation grew 28%, while the classic spray and pray lures went into steep decline.
The report is based on inbound email security data from KnowBe4 Defend, which processes 1.15 billion event signals every day. Overall phishing volume grew 29.8% year over year, and organizations received an average of one dangerous email for every 733 emails. In other words, the problem is not shrinking, it is getting smarter.
What is collapsing and what is replacing it
The declines are as revealing as the increases. Mobile focused scams fell 47.3%, 419 advanced fee fraud dropped 31.3% and missed message lures fell 11.3%. Attackers have concluded that generic bait no longer pays, and they are spending their time on research and tailoring instead.
The replacement tactics are more dangerous precisely because they are harder to spot. A phishing email that references your actual supplier, your actual finance workflow and this week’s actual news headline does not look like a phishing email.
Attackers now sit on trusted infrastructure
In the third quarter of 2026, an attack was two times more likely to originate from legitimate infrastructure compared to the second quarter, with AI platforms named as the newest frontier in this trend. Threat actors are hosting fake developer consoles, sign in prompts and download hubs directly on native AI platform domains. According to the report, large language models such as Claude and ChatGPT are being turned into phishing hosts on their own trusted domains.
This is the detail that should reframe how you think about email authentication. When an attacker sends from a domain that passes reputation checks because the domain is genuinely reputable, the trust signal itself becomes the weapon.
The rented phishing economy
Commercial toolkits are scaling attacks at industrial volume. Toolkit driven phishing grew 54% and now accounts for 29.2% of all inbound malicious mail, with just three primary toolkits responsible for 90.2% of all kit driven phishing. KnowBe4 also reports that 41.3% of phishing now bypasses traditional secure email gateways outright, which means gateway customers are absorbing a large share of the problem without knowing it.
The newsjacking angle is equally striking. Leveraging generative AI and agentic tools, attackers are now 5.4 times faster at turning breaking news headlines into active phishing lures compared to 2022, with a turnaround of less than 16 hours from headline to lure.
Passwords are no longer the target
The report highlights a move away from stealing credentials toward harvesting permissions. Attackers increasingly bypass passwords through authentication phishing, device code logins on platforms like Microsoft Teams, and OAuth consent abuse to hijack sessions and AI agent permissions. Tokens issued this way can persist for more than 90 days and require manual, admin level revocation to remove.
Business Email Compromise accounts for 51.2% of phish types, with HR, Finance and Executive Leadership named as the most targeted departments, and 90.4% of phishing emails arrive on working days, peaking on Monday at 20.6% when inboxes are busiest.
What this means for DMARC and deliverability
None of this makes DMARC less important. It makes it one layer of a defense that needs more layers. When your own domain is spoofed, an enforcing DMARC policy still stops the message at the receiving mailbox. That branch of the attack tree remains yours to close, and closing it has become cheaper than ever.
What the KnowBe4 data changes is the assumption that authentication equals safety. Attackers who send from legitimate platforms, or who have already harvested a valid session or OAuth grant, will pass the checks your filters trust most. That is why DMARC reports deserve daily attention, why outbound anomaly monitoring matters, and why unusual mailbox behavior, not just suspicious links, should trigger review.
The uncomfortable conclusion from Volume 8 is that trust signals alone are no longer proof of safety. As Jack Chapman, SVP of Threat Intelligence at KnowBe4, put it, modern phishing has no need to fool security filters with lookalike domains if attackers can sit directly on trusted ones. Protect your domain with enforcement, but never mistake a passing check for a clean message.
Spear phishing that borrows trusted infrastructure and harvested permissions will not show up in a spam folder, and your own domain remains one of the assets attackers want to borrow. Excello Mail shows you exactly what is being sent as your domain, so you can move from monitoring to enforcement with confidence. Sign up for free to Excello Mail and take control of your domain’s identity.