# Zscaler ThreatLabz 2026 Phishing Report: Volume Falls 20% as AI Trades Mass Spam for Targeted, Higher-Conversion Credential & Session-Theft Campaigns

> Zscaler's ThreatLabz 2026 Phishing & Initial Access Report finds overall phishing volume down ~20% for a second straight year, but risk rising as adversaries pivot from spray-and-pray to AI-accelerated, high-fidelity, higher-conversion campaigns. The services sector saw a 65.5% YoY surge, 95%+ of phishing now hides in encrypted traffic, and attackers increasingly stand up disposable infrastructure on public cloud (AWS) using AiTM/BiTM kits like BlackForce to steal credentials, MFA codes, and live sessions.

- **Published:** 2026-06-14T00:00:00Z
- **Last reviewed:** 2026-06-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0794
- **ID:** TL-2026-0794
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On June 10, 2026, at Zenith Live in Las Vegas, Zscaler ThreatLabz released its 2026 Phishing & Initial Access Report, drawing on telemetry from the Zscaler Zero Trust Exchange (over 500 trillion daily signals across 2025) supplemented by deception/decoy data collected between October 2025 and March 2026. The headline finding is a paradox: total phishing volume fell roughly 20% year-over-year for the second consecutive year (after activity peaked above 2 billion hits in 2023), yet defensive risk is increasing because attackers have re-tooled around quality over quantity. Generative AI has collapsed the cost and time of building convincing lures and landing pages — ThreatLabz catalogued 413,524 AI-generated website instances, of which 37,447 (nearly 10%) were classified as malicious, built with mainstream AI app builders such as Manus AI, Blackbox AI, Anything AI, Bolt AI, Vercel v0, Framer AI, and Lovable AI. One concrete case: a counterfeit Coinbase Wallet site generated with an AI application builder, hosted on a legitimate platform, promoting a malicious browser extension.

The campaigns are increasingly targeted and trust-abusing. The services sector recorded a 65.5% YoY increase in phishing hits — the most-targeted industry in the dataset — as adversaries weaponize trust-based business workflows: billing notices, renewals, onboarding and HR documents, support requests, and document-sharing flows. Manufacturing and government were primary email-phishing targets, with government hits up roughly 50%; the United States remained the top target for email phishing. One observed campaign used tax-themed lures abusing the legitimate Microsoft OneDrive service to target more than 29,000 users. Microsoft and Google were the most-impersonated brands.

Evasion and credential/session theft define the tradecraft. Over 95% (95.2%) of phishing activity was delivered over encrypted channels and 87% of all malicious activity blocked in 2025 traveled via HTTPS, blinding legacy stacks that lack deep TLS inspection. Phishing-as-a-service kits such as BlackForce combine adversary-in-the-middle (AiTM) and browser-in-the-middle (BiTM) techniques to capture credentials, one-time MFA codes, and session tokens in real time — turning a single click into a session-level compromise that bypasses multi-factor authentication. Attackers provision infrastructure quickly on public cloud and discard it when blocked: ThreatLabz observed more than 121,000 AWS-hosted IP addresses probing customer environments, and 89.9 million hostile interactions from 1.37 million unique attacker IPs hit external decoys between October 2025 and March 2026. Hosting origins shifted geographically — Brazil saw a 2,522% surge in phishing hosting to become a top-five global origin — while phishing activity dropped sharply in countries such as Canada and Spain. The net effect is fewer, sharper, more credible attacks that convert at higher rates and produce larger losses, even as raw volume and complaint counts decline.

## MITRE ATT&CK

- T1595 Active Scanning
- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1583.001 Domains
- T1608.001 Upload Malware
- T1585 Establish Accounts
- T1566 Phishing
- T1566.002 Spearphishing Link
- T1566.001 Spearphishing Attachment
- T1199 Trusted Relationship
- T1204.001 Malicious Link
- T1557 Adversary-in-the-Middle
- T1056.003 Web Portal Capture
- T1539 Steal Web Session Cookie
- T1621 Multi-Factor Authentication Request Generation
- T1573 Encrypted Channel
- T1684.001 Impersonation
- T1036 Masquerading
- T1102 Web Service
- T1573.002 Asymmetric Cryptography
- T1176 Software Extensions
- T1557 Adversary-in-the-Middle

## Sources

- [Phishing Attack Volume Down 20%, But Risk Still Rising (Dark Reading)](https://www.darkreading.com/cybersecurity-analytics/phishing-volume-down-20-risk-rising)
- [Zscaler Research Finds Cybercrime Economics Are Shifting as AI Trades Mass Volume for Lethal Precision (GlobeNewswire press release)](https://www.globenewswire.com/news-release/2026/06/10/3309665/0/en/Zscaler-Research-Finds-Cybercrime-Economics-Are-Shifting-as-AI-Trades-Mass-Volume-for-Lethal-Precision.html)
- [Cybercriminals are moving away from mass phishing campaigns (Help Net Security)](https://www.helpnetsecurity.com/2026/06/12/zscaler-report-phishing-activity-trends/)
- [Zscaler ThreatLabz Uncovers Surge in AI-Driven Cyberattacks Targeting Critical Business Operations (Zscaler IR)](https://ir.zscaler.com/news-releases/news-release-details/zscaler-threatlabz-uncovers-surge-ai-driven-cyberattacks)
- [AI sharpens phishing despite lower volumes (Arabian Post)](https://thearabianpost.com/ai-sharpens-phishing-despite-lower-volumes/)
- [Zscaler Research Finds Cybercrime Economics Are Shifting (StockTitan / ZS)](https://www.stocktitan.net/news/ZS/zscaler-research-finds-cybercrime-economics-are-shifting-as-ai-xr6mjy16k2du.html)
- [MITRE ATT&CK T1566 Phishing](https://attack.mitre.org/techniques/T1566/)
- [MITRE ATT&CK T1557 Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0794