Cybercriminals are moving away from high-volume, indiscriminate phishing campaigns towards researched, identity-focused attacks, according to KnowBe4’s Phishing Threat Trends Report, Vol. 8. Spear phishing increased by 41.1% year-on-year, while pre-attack scouting rose 33.7% and company impersonation grew 28%.
The report found that overall phishing volume rose 29.8% year-on-year, with organisations receiving an average of one dangerous email for every 733 emails.
Singapore’s dual threat
Singapore stands out in the Asia-Pacific findings. Advance-fee, or 419, fraud accounted for 24.4% of dangerous email in the city-state — 5.2 times the global average of 4.7% — indicating that legacy financial scams remain a material local risk.
At the same time, colleague impersonation reached 15.9% in Singapore, the highest rate recorded in any market globally. This combination suggests Singapore organisations face both traditional fraud attempts and more sophisticated attacks that exploit internal trust and workplace relationships.
Jack Chapman, senior vice-president of threat intelligence at KnowBe4, said conventional phishing advice is losing effectiveness as attackers operate from legitimate platforms rather than lookalike domains.
Jack Chapman
“Modern phishing has no need to fool security filters with lookalike domains if attackers can sit directly on trusted ones. Attackers can now borrow legitimate infrastructure, harvest permissions instead of passwords, and react to news headlines at machine speed.” Jack Chapman
Trusted infrastructure exploited
The report found that in the third quarter of 2026, attacks were twice as likely to originate from legitimate infrastructure as in the previous quarter. Threat actors are increasingly hosting fake developer consoles, sign-in pages and download hubs on native AI platform domains, using trusted brands to evade suspicion.
Generative AI and agentic tools have also accelerated campaign creation. Attackers are now 5.4 times faster at converting breaking news headlines into phishing lures than they were in 2022, increasing the risk of rapid, topical social-engineering campaigns across Asian markets.
Commercial phishing kits are further scaling the threat. Toolkit-driven phishing increased 54% and now represents 29.2% of inbound malicious email, with three primary toolkits responsible for 90.2% of kit-driven attacks.
Authentication under pressure
The report highlights a shift from password theft towards session and permission hijacking. Attackers are using authentication phishing, device-code login prompts on platforms such as Microsoft Teams, and OAuth consent abuse to compromise accounts and AI agent permissions.
Business email compromise remains the largest phishing category, accounting for 51.2% of phish types. Human resources, finance and executive leadership are the most targeted departments, while 90.4% of phishing emails arrive on weekdays, peaking on Mondays at 20.6%.
The findings point to a need to reassess trust models: verifying sender addresses and links remains important, but organisations must also govern identity, cloud permissions, OAuth grants and AI-agent access.
