Phishing Threat Trends Report Vol 8 shows UAE malware and pre-attack scouting at more than twice the global average, as hyper-targeted attacks, weaponized AI platforms and rapid news hijacking take hold
Dubai, UAE., (October 29, 2026) – KnowBe4, the global leader in digital workforce security, securing both humans and AI agents, today announced the release of its Phishing Threat Trends Report, Vol. 8. The report reveals a fundamental shift in cybercrime tactics: mass, low-effort commodity fraud is in steep decline as threat actors focus on hyper-targeted identity attacks, abusing trusted cloud and AI infrastructure, and bypassing traditional authentication defenses. In the UAE, the shift is only partly visible. Attackers are investing in reconnaissance, but they still rely on file-based malware and mobile lures that are falling away in other markets.
The Phishing Threat Trends Report is based on KnowBe4’s Inbound Email Security data from KnowBe4 Defend, which processes 1.15 billion event signals daily. According to the report, overall phishing volume grew 29.8% year-over-year, with organizations receiving an average of one dangerous email for every 733 emails received. However, the nature of these attacks has changed. Indiscriminate ‘spray and pray’ campaigns saw sharp drops – mobile-focused scams fell 47.3%, 419 (advanced-fee) fraud dropped 31.3%, and missed message lures fell 11.3%. In their place, adversaries are investing heavily in pre-attack research and tailored approaches – spear phishing increased 41.1%, pre-attack scouting increased 33.7%, and company impersonation increased 28%.
Most regions have moved away from file-based payloads, but not the UAE, where malware accounts for 6.7% of dangerous mail, 2.3 times the global average of 2.9%. Attackers are also laying more groundwork, with pre-attack scouting at 4.6% against 2.2% globally. Mobile-focused lures reach 10.0% of dangerous mail, almost four times the global 2.7%, even as this tactic fell 47.3% worldwide. The pattern in the UAE is to research targets first and then deliver a malicious file.
“For years, security advice has focused on a predictable checklist; check the sender address, hover over the link and look for the padlock,” said Jack Chapman, SVP of Threat Intelligence at KnowBe4. “While still foundational, that guidance is becoming less useful by the day. Modern phishing has no need to fool security filters with lookalike domains if attackers can sit directly on trusted ones. Attackers can now borrow legitimate infrastructure, harvest permissions instead of passwords, and react to news headlines at machine speed. Trust signals alone are no longer proof of safety and organizations must rethink where trust belongs as they protect their workforce.”
Key Findings from Phishing Threat Trends Report Vol. 8:
- In Q3 2026, an attack was two times more likely to originate from legitimate infrastructure compared to Q2 2026, with AI platforms as the newest frontier in this trend.
- Threat actors are increasingly hosting fake developer consoles, sign-in prompts, and download hubs directly on native AI platform domains.
- Leveraging generative AI and agentic tools, attackers are now 5.4 times faster at turning breaking news headlines into active phishing lures compared to 2022.
- Commercial toolkits are scaling attacks at volume. Toolkit-driven phishing grew 54% to account for 29.2% of all inbound malicious mail, with just three primary toolkits accounting for 90.2% of all kit-driven phishing.
- Attackers are increasingly bypassing passwords through authentication phishing, device-code logins on platforms like Microsoft Teams, and OAuth consent abuse to hijack sessions and AI agent permissions.
- 4% of phishing emails arrive during working days (Monday–Friday), peaking on Monday at 20.6% when inboxes are busiest. Business Email Compromise (BEC) accounts for 51.2% of phish types, with HR, Finance, and Executive Leadership named as the most targeted departments.
