Threat reportPhishingTL-2026-0878
Zscaler ThreatLabz 2026 Report: Encrypted Phishing & AiTM/BiTM Initial-Access Campaigns Targeting the Public Sector
Zscaler ThreatLabz 2026 Report (TL-2026-0878), also tracked as One Click to Compromise, is a high-severity phishing campaign, first published 2026-06-19. It has no confirmed attribution, affects Microsoft Microsoft 365 / Entra ID identity (most-impersonated brand, maps to 18 MITRE ATT&CK techniques (T1056.003, T1078, T1078.004), and is covered by 9 detection rules and 18 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 18MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 18Indicators of compromise
Key facts for TL-2026-0878
- Threat ID
- TL-2026-0878
- Also known as
- One Click to Compromise, ThreatLabz 2026 Phishing and Initial Access Report
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- government, healthcare, education, financial, services
- Target regions
- North America, Europe, South America
- Detection rules
- 9
- Indicators of compromise
- 18
Malware and tooling in Zscaler ThreatLabz 2026 Report
Malware and tooling: AiTM reverse-proxy / BiTM remote-browser relay, BlackForce, EvilProxy, Evilginx, Sneaky 2FA, Tycoon 2FA
How Zscaler ThreatLabz 2026 Report works
Zscaler ThreatLabz's 2026 Phishing and Initial Access Report documents a 50% year-over-year surge in phishing against government (138.5M hits in 2025, the third-most-targeted industry), with 95.2% of phishing now delivered over encrypted channels. Adversary-in-the-middle (AiTM) and browser-in-the-middle (BiTM) phishing-as-a-service kits capture credentials and live MFA session tokens, while AI website-builder tools mass-produce high-fidelity phishing infrastructure.
The Zscaler ThreatLabz 2026 Phishing and Initial Access Report ("One Click to Compromise") and its public-sector companion analysis describe a structural shift in initial-access tradecraft: overall phishing volume in the Zscaler cloud fell ~20% year over year (in both 2024 and 2025), but the surviving campaigns are more targeted, more AI-assisted, and harder to distinguish from legitimate activity. Government phishing rose 50% YoY to 138.5 million hits in 2025, ranking government the third-most-targeted industry; the Services sector saw the largest surge, climbing 65.5% from 330.9M to 547.7M hits. 95.2% of all phishing activity is now delivered over encrypted (TLS) channels, defeating defenses that do not perform consistent encrypted-traffic inspection.
The report's central tradecraft finding is the operationalization of adversary-in-the-middle (AiTM) and browser-in-the-middle (BiTM) phishing kits. These kits position a reverse proxy (or a remotely controlled browser session) between the victim and the legitimate identity provider, relaying the authentication flow in real time to capture both credentials and the post-MFA session cookie. Because the live session token is stolen after the MFA challenge succeeds, the attacker turns a single click into session-level compromise and bypasses legacy MFA (SMS one-time codes, TOTP, and push notifications). ThreatLabz cites BlackForce as an example phishing-as-a-service platform in this ecosystem; corroborating public research documents the broader AiTM PhaaS market — Tycoon 2FA (attributed to Storm-1747), EvilProxy, Sneaky 2FA, NakedPages, and the open-source Evilginx framework — sold for roughly $100-$1,000 per month and mapping to MITRE T1557 (Adversary-in-the-Middle), T1539 (Steal Web Session Cookie), and T1556.006 (Modify Authentication Process: MFA).
A second major theme is AI-generated phishing infrastructure. ThreatLabz identified 413,524 AI-generated site instances across the analysis period, of which 37,447 (9.06%) were flagged as malicious. The generation platforms most attributed were Manus AI (15.6%), Blackbox AI (14.3%), and Anything AI (9.8%), alongside DeepSite AI and Lovable AI. These tools let adversaries spin up pixel-accurate brand-impersonation sites in minutes rather than days. A specific observed campaign impersonated Brazilian government services (paired with instant-payment-system credential theft) using DeepSite AI and Blackbox AI. Microsoft and Google remain the most-impersonated brands, abused via credential-harvesting pages, SEO poisoning, and QR-code redirects.
The report also frames reconnaissance as a leading indicator of intrusion: ThreatLabz recorded 89.9 million hostile interactions with external decoys over six months and 121,000+ distinct AWS-hosted IPs probing customer environments. For the public sector specifically, healthcare saw 1.58 million encrypted attack hits while education recorded 1.6 billion encrypted attack hits over the year despite a 65.6% YoY decline in phishing attempts. Recommended defenses center on consistent TLS inspection, FIDO2/phishing-resistant authentication, identity-based least-privilege access that minimizes application exposure, monitoring for AI-generated phishing infrastructure, and extending visibility beyond the inbox to browsers, authentication flows, and SaaS sessions.
MITRE ATT&CK techniques used in TL-2026-0878
Credential Access
T1056.003 Web Portal Capture; T1539 Steal Web Session Cookie; T1556.006 Multi-Factor Authentication; T1557 Adversary-in-the-Middle
Persistence
Initial Access
T1078.004 Cloud Accounts; T1189 Drive-by Compromise; T1566 Phishing; T1566.002 Spearphishing Link
command-and-control
T1102 Web Service; T1573 Encrypted Channel
Command and Control
T1102.002 Bidirectional Communication
Resource Development
T1583 Acquire Infrastructure; T1588.002 Tool; T1608.005 Link Target
Reconnaissance
T1589 Gather Victim Identity Information; T1595 Active Scanning
stealth
Affected products and versions in Zscaler ThreatLabz 2026 Report
- Microsoft — Microsoft 365 / Entra ID identity (most-impersonated brand; AiTM session-cookie theft target)
Vulnerable versions: legacy MFA: SMS OTP, TOTP, push notifications
Fixed in: FIDO2 / WebAuthn phishing-resistant authentication - Google — Google Workspace identity (most-impersonated brand; AiTM session-cookie theft target)
Vulnerable versions: legacy MFA: SMS OTP, TOTP, push notifications
Fixed in: FIDO2 / WebAuthn phishing-resistant authentication - Public Sector — Government, healthcare, and education organizations (third-most-targeted industry; Brazilian government services impersonation observed)
Vulnerable versions: organizations without consistent TLS inspection or phishing-resistant MFA
Fixed in: Zero Trust + FIDO2 + encrypted-traffic inspection
Remediation for Zscaler ThreatLabz 2026 Report
Immediate actions
- Inspect encrypted/TLS traffic consistently at the proxy/gateway so the 95.2% of phishing delivered over encrypted channels is not invisible
- Hunt for and revoke anomalous active session cookies; enforce short session lifetimes and re-authentication on sensitive actions to blunt AiTM session-token replay
- Block known AiTM/BiTM PhaaS and AI-website-builder infrastructure (Manus AI, Blackbox AI, Anything AI, DeepSite AI, Lovable AI generated sites flagged malicious)
Workarounds
- Conditional-access policies binding sessions to device compliance and network/location to reduce stolen-cookie replay value
- Block or sandbox QR-code links and newly-registered look-alike domains; restrict use of unmanaged browsers for privileged identity flows
Longer-term hardening
- Deploy FIDO2/WebAuthn phishing-resistant authentication to remove the most reliable click-to-session-compromise path
- Apply identity-based least-privilege (Zero Trust) access controls that minimize public application exposure
- Extend monitoring beyond the inbox to browsers, authentication flows, and SaaS sessions; deploy deception/decoy technology for early reconnaissance detection
Weaknesses (CWE) in Zscaler ThreatLabz 2026 Report
Timeline of Zscaler ThreatLabz 2026 Report
- Tycoon 2FA AiTM phishing-as-a-service kit first observed (attributed to Storm-1747), industrializing real-time MFA-bypass tradecraft later seen across the 2026 ecosystem.
- Overall phishing volume in the Zscaler cloud begins its ~20% year-over-year decline, continuing through 2024 and 2025 as campaigns shift to targeted, AI-assisted operations.
- 2025 telemetry period analyzed: government phishing reaches 138.5 million hits (+50% YoY); Services industry climbs 65.5% from 330.9M to 547.7M hits.
- Six-month window recording 89.9 million hostile interactions with external decoys and 121,000+ distinct AWS-hosted IPs probing customer environments.
- 413,524 AI-generated site instances identified; 37,447 (9.06%) flagged malicious, attributed to Manus AI (15.6%), Blackbox AI (14.3%), Anything AI (9.8%), DeepSite AI and Lovable AI.
- Observed campaign impersonating Brazilian government services using DeepSite AI and Blackbox AI, paired with instant-payment-system credential theft.
- Microsoft publishes in-depth analysis of Tycoon2FA AiTM operations at scale, corroborating the PhaaS MFA-bypass tradecraft described by ThreatLabz.
- Zscaler ThreatLabz publishes the 2026 Phishing and Initial Access Report ('One Click to Compromise') and press release noting a nearly 50% increase in phishing with education, finance, and government most targeted.
- Zscaler publishes the public-sector companion analysis: 95.2% of phishing over encrypted channels; government third-most-targeted; healthcare 1.58M and education 1.6B encrypted attack hits.
Sources cited for Zscaler ThreatLabz 2026 Report
- What the ThreatLabz 2026 Phishing and Initial Access Report Means for the Public Sector
- One Click to Compromise: ThreatLabz 2026 Phishing and Initial Access Report
- Zscaler ThreatLabz Research Shows a Nearly 50% Increase in Phishing Attacks
- Cybercriminals are moving away from mass phishing campaigns (Help Net Security)
- One Click to Compromise: ThreatLabz 2026 Phishing and Initial Access Report (Security Boulevard)
- Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale (Microsoft Security Blog)
- Tycoon 2FA: Phishing Kit Being Used to Bypass MFA (Proofpoint)
- Tycoon 2FA: an in-depth analysis of the latest version of the AiTM phishing kit (Sekoia)
Detection coverage for TL-2026-0878
As of 2026-06-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0878 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.