Threat reportPhishingTL-2026-0794
Zscaler ThreatLabz 2026 Phishing Report: Volume Falls 20% as AI Trades Mass Spam for Targeted, Higher-Conversion Credential & Session-Theft Campaigns
Zscaler ThreatLabz 2026 Phishing Report (TL-2026-0794), also tracked as Zscaler ThreatLabz 2026 Phishing Report, is a medium-severity phishing campaign, first published 2026-06-14. It has no confirmed attribution, affects Multiple Enterprise email and identity / SSO (credential and MFA, maps to 21 MITRE ATT&CK techniques (T1036, T1056.003, T1102), and is covered by 9 detection rules and 18 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 21MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 18Indicators of compromise
Key facts for TL-2026-0794
- Threat ID
- TL-2026-0794
- Also known as
- Zscaler ThreatLabz 2026 Phishing Report, ThreatLabz 2026 Phishing and Initial Access Report
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- services, government, manufacturing, financial, technology
- Target regions
- North America, United States, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 18
Malware and tooling in Zscaler ThreatLabz 2026 Phishing Report
Malware and tooling: BlackForce
How Zscaler ThreatLabz 2026 Phishing Report works
Zscaler's ThreatLabz 2026 Phishing & Initial Access Report finds overall phishing volume down ~20% for a second straight year, but risk rising as adversaries pivot from spray-and-pray to AI-accelerated, high-fidelity, higher-conversion campaigns. The services sector saw a 65.5% YoY surge, 95%+ of phishing now hides in encrypted traffic, and attackers increasingly stand up disposable infrastructure on public cloud (AWS) using AiTM/BiTM kits like BlackForce to steal credentials, MFA codes, and live sessions.
On June 10, 2026, at Zenith Live in Las Vegas, Zscaler ThreatLabz released its 2026 Phishing & Initial Access Report, drawing on telemetry from the Zscaler Zero Trust Exchange (over 500 trillion daily signals across 2025) supplemented by deception/decoy data collected between October 2025 and March 2026. The headline finding is a paradox: total phishing volume fell roughly 20% year-over-year for the second consecutive year (after activity peaked above 2 billion hits in 2023), yet defensive risk is increasing because attackers have re-tooled around quality over quantity. Generative AI has collapsed the cost and time of building convincing lures and landing pages — ThreatLabz catalogued 413,524 AI-generated website instances, of which 37,447 (nearly 10%) were classified as malicious, built with mainstream AI app builders such as Manus AI, Blackbox AI, Anything AI, Bolt AI, Vercel v0, Framer AI, and Lovable AI. One concrete case: a counterfeit Coinbase Wallet site generated with an AI application builder, hosted on a legitimate platform, promoting a malicious browser extension.
The campaigns are increasingly targeted and trust-abusing. The services sector recorded a 65.5% YoY increase in phishing hits — the most-targeted industry in the dataset — as adversaries weaponize trust-based business workflows: billing notices, renewals, onboarding and HR documents, support requests, and document-sharing flows. Manufacturing and government were primary email-phishing targets, with government hits up roughly 50%; the United States remained the top target for email phishing. One observed campaign used tax-themed lures abusing the legitimate Microsoft OneDrive service to target more than 29,000 users. Microsoft and Google were the most-impersonated brands.
Evasion and credential/session theft define the tradecraft. Over 95% (95.2%) of phishing activity was delivered over encrypted channels and 87% of all malicious activity blocked in 2025 traveled via HTTPS, blinding legacy stacks that lack deep TLS inspection. Phishing-as-a-service kits such as BlackForce combine adversary-in-the-middle (AiTM) and browser-in-the-middle (BiTM) techniques to capture credentials, one-time MFA codes, and session tokens in real time — turning a single click into a session-level compromise that bypasses multi-factor authentication. Attackers provision infrastructure quickly on public cloud and discard it when blocked: ThreatLabz observed more than 121,000 AWS-hosted IP addresses probing customer environments, and 89.9 million hostile interactions from 1.37 million unique attacker IPs hit external decoys between October 2025 and March 2026. Hosting origins shifted geographically — Brazil saw a 2,522% surge in phishing hosting to become a top-five global origin — while phishing activity dropped sharply in countries such as Canada and Spain. The net effect is fewer, sharper, more credible attacks that convert at higher rates and produce larger losses, even as raw volume and complaint counts decline.
MITRE ATT&CK techniques used in TL-2026-0794
Defense Evasion
Credential Access
T1056.003 Web Portal Capture; T1539 Steal Web Session Cookie; T1557 Adversary-in-the-Middle; T1621 Multi-Factor Authentication Request Generation
Command and Control
T1102 Web Service; T1573.002 Asymmetric Cryptography
Persistence
Initial Access
T1199 Trusted Relationship; T1566 Phishing; T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link
Execution
Collection
command-and-control
Resource Development
T1583 Acquire Infrastructure; T1583.001 Domains; T1585 Establish Accounts; T1608.001 Upload Malware
Reconnaissance
T1589 Gather Victim Identity Information; T1595 Active Scanning
stealth
Affected products and versions in Zscaler ThreatLabz 2026 Phishing Report
- Multiple — Enterprise email and identity / SSO (credential and MFA flows)
Vulnerable versions: Microsoft 365 / Google Workspace logins targeted via AiTM/BiTM
Fixed in: Phishing-resistant FIDO2/WebAuthn passkeys mitigate - Microsoft — OneDrive (abused as legitimate hosting in tax-themed lure campaign)
Vulnerable versions: Document-sharing workflows abused for delivery
Remediation for Zscaler ThreatLabz 2026 Phishing Report
Immediate actions
- Enforce deep TLS/SSL inspection at the proxy so that 95%+ of phishing hidden in encrypted traffic is actually examined
- Deploy phishing-resistant MFA (FIDO2/WebAuthn passkeys) to defeat AiTM/BiTM session-token theft kits like BlackForce
- Bind sessions to device posture and revoke/short-TTL session tokens; alert on impossible-travel and new-device session reuse
- Block or closely monitor newly registered domains and disposable public-cloud-hosted IPs used for credential-harvesting pages
Workarounds
- Disable legacy authentication and conditional-access bypasses that allow stolen tokens to be replayed
- Restrict OAuth app consent and browser-extension installation to defeat malicious-extension lures
Longer-term hardening
- Adopt a Zero Trust architecture that brokers every connection rather than trusting network location
- Roll out continuous user security-awareness training focused on trust-abuse lures (billing, renewals, HR, tax, document-sharing)
- Deploy deception/decoy assets to surface reconnaissance from attacker IPs before initial access succeeds
- Integrate brand-abuse and AI-generated-clone monitoring to detect counterfeit Microsoft/Google/Coinbase login pages
Weaknesses (CWE) in Zscaler ThreatLabz 2026 Phishing Report
Timeline of Zscaler ThreatLabz 2026 Phishing Report
- Global phishing activity peaks above 2 billion hits per Zscaler telemetry, the high-water mark before two consecutive years of decline.
- Phishing volume declines roughly 20% year-over-year for the first time as attackers begin shifting away from mass spray-and-pray campaigns.
- Phishing volume falls another ~20% (second consecutive annual decline) while AI-accelerated, higher-conversion targeted campaigns rise.
- Start of the deception/decoy collection window: external decoys begin recording hostile reconnaissance interactions in customer environments.
- Zscaler Zero Trust Exchange telemetry for calendar-year 2025 (500+ trillion daily signals) forms the core dataset; 95.2% of phishing observed in encrypted traffic, 87% of blocked malicious activity over HTTPS.
- End of deception window: 89.9 million hostile interactions from 1.37 million unique attacker IPs recorded; 121,000+ AWS-hosted IPs observed probing environments.
- Zscaler ThreatLabz publishes the 2026 Phishing & Initial Access Report at Zenith Live in Las Vegas, documenting 413,524 AI-generated site instances (37,447 malicious) and the BlackForce AiTM/BiTM PhaaS kit.
- Help Net Security and other outlets report the findings, detailing the services-sector 65.5% surge, Brazil's 2,522% hosting surge, and declines in Canada and Spain.
- Dark Reading frames the trend as 'volume down 20%, risk rising,' emphasizing higher victim losses despite flat complaint counts.
Sources cited for Zscaler ThreatLabz 2026 Phishing Report
- Phishing Attack Volume Down 20%, But Risk Still Rising (Dark Reading)
- Zscaler Research Finds Cybercrime Economics Are Shifting as AI Trades Mass Volume for Lethal Precision (GlobeNewswire press release)
- Cybercriminals are moving away from mass phishing campaigns (Help Net Security)
- Zscaler ThreatLabz Uncovers Surge in AI-Driven Cyberattacks Targeting Critical Business Operations (Zscaler IR)
- AI sharpens phishing despite lower volumes (Arabian Post)
- Zscaler Research Finds Cybercrime Economics Are Shifting (StockTitan / ZS)
- MITRE ATT&CK T1566 Phishing
- MITRE ATT&CK T1557 Adversary-in-the-Middle
Detection coverage for TL-2026-0794
As of 2026-06-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0794 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.