# Zscaler ThreatLabz 2026 Report: Encrypted Phishing & AiTM/BiTM Initial-Access Campaigns Targeting the Public Sector

> Zscaler ThreatLabz's 2026 Phishing and Initial Access Report documents a 50% year-over-year surge in phishing against government (138.5M hits in 2025, the third-most-targeted industry), with 95.2% of phishing now delivered over encrypted channels. Adversary-in-the-middle (AiTM) and browser-in-the-middle (BiTM) phishing-as-a-service kits capture credentials and live MFA session tokens, while AI website-builder tools mass-produce high-fidelity phishing infrastructure.

- **Published:** 2026-06-19T00:00:00Z
- **Last reviewed:** 2026-06-19T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0878
- **ID:** TL-2026-0878
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

The Zscaler ThreatLabz 2026 Phishing and Initial Access Report ("One Click to Compromise") and its public-sector companion analysis describe a structural shift in initial-access tradecraft: overall phishing volume in the Zscaler cloud fell ~20% year over year (in both 2024 and 2025), but the surviving campaigns are more targeted, more AI-assisted, and harder to distinguish from legitimate activity. Government phishing rose 50% YoY to 138.5 million hits in 2025, ranking government the third-most-targeted industry; the Services sector saw the largest surge, climbing 65.5% from 330.9M to 547.7M hits. 95.2% of all phishing activity is now delivered over encrypted (TLS) channels, defeating defenses that do not perform consistent encrypted-traffic inspection.

The report's central tradecraft finding is the operationalization of adversary-in-the-middle (AiTM) and browser-in-the-middle (BiTM) phishing kits. These kits position a reverse proxy (or a remotely controlled browser session) between the victim and the legitimate identity provider, relaying the authentication flow in real time to capture both credentials and the post-MFA session cookie. Because the live session token is stolen after the MFA challenge succeeds, the attacker turns a single click into session-level compromise and bypasses legacy MFA (SMS one-time codes, TOTP, and push notifications). ThreatLabz cites BlackForce as an example phishing-as-a-service platform in this ecosystem; corroborating public research documents the broader AiTM PhaaS market — Tycoon 2FA (attributed to Storm-1747), EvilProxy, Sneaky 2FA, NakedPages, and the open-source Evilginx framework — sold for roughly $100-$1,000 per month and mapping to MITRE T1557 (Adversary-in-the-Middle), T1539 (Steal Web Session Cookie), and T1556.006 (Modify Authentication Process: MFA).

A second major theme is AI-generated phishing infrastructure. ThreatLabz identified 413,524 AI-generated site instances across the analysis period, of which 37,447 (9.06%) were flagged as malicious. The generation platforms most attributed were Manus AI (15.6%), Blackbox AI (14.3%), and Anything AI (9.8%), alongside DeepSite AI and Lovable AI. These tools let adversaries spin up pixel-accurate brand-impersonation sites in minutes rather than days. A specific observed campaign impersonated Brazilian government services (paired with instant-payment-system credential theft) using DeepSite AI and Blackbox AI. Microsoft and Google remain the most-impersonated brands, abused via credential-harvesting pages, SEO poisoning, and QR-code redirects.

The report also frames reconnaissance as a leading indicator of intrusion: ThreatLabz recorded 89.9 million hostile interactions with external decoys over six months and 121,000+ distinct AWS-hosted IPs probing customer environments. For the public sector specifically, healthcare saw 1.58 million encrypted attack hits while education recorded 1.6 billion encrypted attack hits over the year despite a 65.6% YoY decline in phishing attempts. Recommended defenses center on consistent TLS inspection, FIDO2/phishing-resistant authentication, identity-based least-privilege access that minimizes application exposure, monitoring for AI-generated phishing infrastructure, and extending visibility beyond the inbox to browsers, authentication flows, and SaaS sessions.

## MITRE ATT&CK

- T1595 Active Scanning
- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1608.005 Link Target
- T1588.002 Tool
- T1566 Phishing
- T1566.002 Spearphishing Link
- T1189 Drive-by Compromise
- T1078.004 Cloud Accounts
- T1557 Adversary-in-the-Middle
- T1539 Steal Web Session Cookie
- T1556.006 Multi-Factor Authentication
- T1056.003 Web Portal Capture
- T1573 Encrypted Channel
- T1684.001 Impersonation
- T1102 Web Service
- T1102.002 Bidirectional Communication
- T1078 Valid Accounts

## Sources

- [What the ThreatLabz 2026 Phishing and Initial Access Report Means for the Public Sector](https://www.zscaler.com/blogs/security-research/what-threatlabz-2026-phishing-and-initial-access-report-means-public-sector)
- [One Click to Compromise: ThreatLabz 2026 Phishing and Initial Access Report](https://www.zscaler.com/blogs/security-research/one-click-compromise-threatlabz-2026-phishing-and-initial-access-report)
- [Zscaler ThreatLabz Research Shows a Nearly 50% Increase in Phishing Attacks](https://ir.zscaler.com/news-releases/news-release-details/zscaler-threatlabz-research-shows-nearly-50-increase-phishing)
- [Cybercriminals are moving away from mass phishing campaigns (Help Net Security)](https://www.helpnetsecurity.com/2026/06/12/zscaler-report-phishing-activity-trends/)
- [One Click to Compromise: ThreatLabz 2026 Phishing and Initial Access Report (Security Boulevard)](https://securityboulevard.com/2026/06/one-click-to-compromise-threatlabz-2026-phishing-and-initial-access-report/)
- [Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale (Microsoft Security Blog)](https://www.microsoft.com/en-us/security/blog/2026/03/04/inside-tycoon2fa-how-a-leading-aitm-phishing-kit-operated-at-scale/)
- [Tycoon 2FA: Phishing Kit Being Used to Bypass MFA (Proofpoint)](https://www.proofpoint.com/us/blog/email-and-cloud-threats/tycoon-2fa-phishing-kit-mfa-bypass)
- [Tycoon 2FA: an in-depth analysis of the latest version of the AiTM phishing kit (Sekoia)](https://blog.sekoia.io/tycoon-2fa-an-in-depth-analysis-of-the-latest-version-of-the-aitm-phishing-kit/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0878