Net fishing increasingly complex was ready for 2026

Phishing in 2026 will become both more complex and harder to detect as AI and advanced phishing methods drive the development forward. In 2025, both the volume and technical level of attacks increased and Barracudas The Threat Analysis Team describes how threats will continue to grow in 2026.

In 2025, phishing attacks took another major leap in complexity driven by AI, readily available phishing services, and advanced techniques to evade detection. In this forward-looking analysis, Barracuda’s Threat Analysis Team provides its view of how the threat landscape is evolving as attackers become more technologically sophisticated and organized.

How phishing will evolve in 2026 based on trends from 2025

The expectation for 2025 was to complete fishing net kit would stand for half of all attacks on login credentials by the end of the year. The outcome was higher than expected as attackers quickly realized the value of complete kits that can be used by both experienced and inexperienced actors. The number of kits also doubled during the year, which led to the further industrialization of phishing. This development lays the foundation for phishing in 2026 where attackers uses more automated and situational methods.

This is what awaits in 2026

The year 2026 marks a clear shift as next-generation phishing kits begin to use AI to create detailed profiles of their targets. Attackers will increasingly use automated techniques to bypass protections such as multi-factor authentication, for example by stealing tokens or forwarding credentials via legitimate websites. The new business model is based on subscription levels from basic packages to advanced AI-driven campaigns. By the end of the year, more than 90 percent of all breaches aimed at stealing login credentials are expected to come from phishing kits, which corresponds to over 60 percent of phishing attacks globally.

Dynamic and situational attacks

Attackers are moving from static approaches to dynamic attacks where language links content and payloads change depending on device behavior or time. This makes attacks significantly harder to detect. Methods expected to increase in 2026 include steganography where malicious code is hidden in images or audio files ClickFix attacks where commands are copied to the clipboard without the user noticing more shared QR codes and entirely new types of dynamic QR codes. Abuse of OAuth continues and Blob URLs running locally in the browser are becoming more common. Dynamic code injection and fully masked malware are also seeing an increase.

AI-adapted and personalized campaigns

Generative AI enables the creation of highly credible and personalized messages at scale. Attackers can quickly change strategy based on how recipients react. These attacks often combine encryption techniques to hide code and customizable payloads. In 2026, more attacks on AI-powered security tools are expected through prompt injection and attacks on AI agents.

Increased attacks against MFA and account recovery

Bypassing MFA is one of the most pronounced trends. Attackers overload users with push requests until someone accidentally approves. Social engineering are also targeting password reset and account recovery features because these processes are often easier to manipulate than the actual MFA technology. Attackers also try to gain users to switch to weaker methods which is easier to circumvent.

Attacks that exploit CAPTCHA

By the end of 2026, over 85 percent of all phishing attacks are expected to use CAPTCHAs to create a sense of legitimacy. Attackers are increasingly building their own fake CAPTCHA solutions that hide the real purpose of the attack and make it harder for users to understand that something is wrong.

More polymorphic methods

Polymorphic attacks, where content and technical characteristics change continuously for each user, are becoming increasingly common. Random character strings, varied sender addresses, unusually long headers, and altered file names are used to evade signature-based protections. In 2025, approximately 10 percent of phishing attacks exploited legitimate services, a level that is expected to persist as AI-powered codeless platforms make it easy to build phishing websites in minutes.

Attacks that exploit URL protection and masking

In 2025, the abuse of URL protection services, tracking links, redirects, and legitimately crafted URLs increased. These techniques were seen in approximately 25 percent of all attacks and are expected to increase in 2026 as attackers become better at masking links.

More advanced malware and fileless attacks

Malware is becoming more sophisticated with a sharp increase in fileless attacks that only exist in memory. Polymorphic payloads that change for each user are becoming more common. Malware-as-a-service services continue to grow, lowering the threshold for new attackers.

As we enter phishing 2026, it becomes clear that organizations must work more proactively to manage the increased risks.

How to protect yourself when threats increase

Phishing has become both more common and more difficult to detect, and the trend will continue in 2026. According to Barracudas According to a recent survey, 78 percent of organizations have experienced an email-related breach in the past year. Traditional protections are no longer enough as attackers work more flexibly and technologically advanced. Reducing risks requires modern security solutions, continuous monitoring, robust authentication methods, multi-layered protection, and a strong security culture.

Read more here.