Phishing Statistics

Vishing intrusions increased by 2x in 1H 2026.

17% of reported cybercrime cases in Africa in 2025 involved online scams, including phishing.

Monthly device code phishing attempts increased 15x in 1H 2026.

In the first half of 2026, 67% of phishing emails passed DMARC.

39% of phishing messages featured novel social engineering techniques.

VIP users were targeted in 25.8% of phishing attacks.

The three most vulnerable industries at baseline are Healthcare & Pharmaceuticals (42.7%), Insurance (38.1%), and Retail & Wholesale (36%).

Organizations reduce phishing susceptibility by 79% after one year of consistent security awareness training.

Before any training, roughly one in three employees is likely to engage with a phishing attempt.

Almost 86% of phishing attacks contain AI-generated elements.

The number of mobile devices where employees clicked a malicious link grew 110% in 2025 compared to 2024.

Phishing events detected on employee mobile devices have grown 380% since January 2025.

Phishing was the primary means of gaining initial access in over half of Cisco Talos Incident Response engagements this quarter, up from approximately one-third of engagements last quarter.

The ARToken panel exposed 80+ API endpoints for device code phishing, primary refresh token persistence, email access, BEC operations, and SharePoint exfiltration.

Microsoft was the most impersonated brand in Q2 2026, appearing in 23% of all brand phishing attempts.

The top five impersonated brands — Microsoft, LinkedIn, Google, Apple, and Amazon — together accounted for more than 50% of all brand phishing attempts this quarter.

Open AI’s ChatGPT entered the top ten most impersonated brands for the first time.

Phishing emails and other email-based social engineering are the initial entry vector in 34% of ransomware incidents.

34% of ransomware incidents begin with phishing emails or other email-based social engineering.

Malicious email (26%) and phishing (24%) together account for 50% of ransomware incidents.

51% of IAM leaders and stakeholders cite the inability to support legacy apps and infrastructure as an obstacle to universal phishing-resistant MFA.

36% of restaurants experienced phishing targeting staff credentials as a form of social engineering in the past year.

Only 28% of the MFA used for workforce authentication in financial services is phishing-resistant.

79% of IAM leaders and stakeholders cite technical or architectural complexity as an obstacle to universal phishing-resistant MFA.

Phishing accounted for 49% of blocked harmful content and phishing volume grew 94% year-on-year.

Phishing websites account for 10.5% of critical exposures, up sharply from 1.0% the year before.

60% of UK cybersecurity professionals say threats are already moving beyond email

66% of UK cybersecurity professionals believe employees are more likely to trust messages received through internal collaboration platforms

62% of cybersecurity professionals are seeing attacks move beyond email

45% of organizations cite reducing phishing and credential-based breach risk as the leading driver for moving to passwordless authentication.

52,185 threats were hosted on domains that enterprise security stacks are configured to trust, including Google Drive, Dropbox, and SharePoint.

Manus AI accounted for 15.6% of attributed AI site builders, Blackbox AI accounted for 14.3%, and Anything AI accounted for 9.8% of attributed builders.

Phishing activity declined by approximately 20% year-over-year in both 2024 and 2025.

Services industry phishing hits surged 65.5% year-over-year from 330.9 million to 547.7 million hits.

One in five phishing links clicked by users went completely undetected by legacy URL filtering.

76% of organizations reported phishing as an intrusion.

50% of organizations rate phishing as a high or extreme threat, up from 33% in 2022.

Phishing costs $51,948 per security analyst annually, a 13.6% increase from $45,726 in 2022.

20% of IT and security professionals expect phishing to get easier to deal with in the next 12 months.

Across the period studied, the use of AI for account discovery rose 8.9% while AI-assisted phishing falls 8.6%.