Phishing-as-a-Service Is Industrializing Email Attacks: Barracuda's 2026 Report and What DMARC Must Do Next

Thu, 28 May 2026 10:00:00 +0000

A single-month scan of 3.1 billion emails. One in three messages flagged as malicious or unwanted spam. Nearly half of all malicious activity originating from phishing. These are the headline numbers from Barracuda’s 2026 Email Threats Report, published May 12, and they paint a threat landscape that has fundamentally changed over the past three years.

What is driving the surge is not just volume. It is industrialization. Phishing-as-a-Service (PhaaS) platforms now power 90% of high-volume phishing campaigns, supplying attackers with ready-made credential-harvesting kits, rotating domains, pre-built evasion logic, and even customer support. The barrier to launching a sophisticated, multi-step phishing operation has collapsed.

Phishing-as-a-Service on Daily DMARC News

Phishing-as-a-Service Is Industrializing Email Attacks: Barracuda's 2026 Report and What DMARC Must Do Next