New threat intelligence report highlights a 41.1% global rise in spear-phishing, increased reconnaissance and growing abuse of trusted AI and cloud platforms.
Organisations in the UAE are facing a distinct phishing threat landscape, with mobile-focused lures accounting for 10% of dangerous emails nearly four times the global average of 2.7%. Malware and pre-attack reconnaissance are also significantly more prevalent than worldwide levels, according to KnowBe4’s Phishing Threat Trends Report, Volume 8.
The findings point to a broader transformation in cybercrime. While indiscriminate phishing campaigns are declining, attackers are increasingly investing in targeted identity attacks, exploiting legitimate cloud infrastructure and using artificial intelligence to accelerate the creation of convincing lures.
Based on data from KnowBe4 Defend, which processes 1.15 billion event signals daily, the report records a 29.8% year-on-year increase in overall phishing volume. Organisations received an average of one dangerous email for every 733 emails. Spear-phishing increased 41.1%, pre-attack scouting rose 33.7% and company impersonation grew 28%.
The UAE’s exposure differs from the global trend. Malware accounts for 6.7% of dangerous emails in the country, compared with 2.9% globally. Pre-attack scouting represents 4.6%, more than twice the worldwide average of 2.2%. The data suggests attackers are researching targets before delivering malicious files or mobile-focused lures.
“Modern phishing has no need to fool security filters with lookalike domains if attackers can sit directly on trusted ones. Trust signals alone are no longer proof of safety, and organizations must rethink where trust belongs.”
— Jack Chapman, SVP of Threat Intelligence, KnowBe4
Globally, attackers are moving away from traditional mass campaigns. Mobile-focused scams declined 47.3%, while advance-fee fraud fell 31.3% and missed-message lures dropped 11.3%.
At the same time, the report identifies legitimate infrastructure as an increasingly important attack vector. In Q3 2026, phishing attacks were twice as likely to originate from legitimate infrastructure as in the previous quarter. Threat actors are hosting fake developer consoles, sign-in prompts and download pages on native AI platform domains, exploiting the trust users place in familiar services.
Generative AI is accelerating this shift. Attackers are now 5.4 times faster at converting breaking news into phishing campaigns than they were in 2022. Toolkit-driven phishing has also increased 54%, accounting for 29.2% of inbound malicious email, with three major toolkits responsible for 90.2% of these campaigns.
The report further highlights the growing abuse of authentication mechanisms, including device-code logins and OAuth consent requests, allowing attackers to hijack sessions and obtain permissions without necessarily stealing passwords.
Jack Chapman, SVP of Threat Intelligence at KnowBe4, said traditional advice such as checking sender addresses and inspecting links is no longer sufficient when attackers exploit trusted platforms and legitimate infrastructure.
For UAE organisations, the findings underline the need to strengthen identity security, scrutinise mobile communications and monitor application permissions alongside conventional email protection. As phishing becomes more targeted and AI-assisted, security strategies will need to focus not only on identifying suspicious messages but also on verifying the legitimacy of the services, identities and permissions behind them.
