Phishing Attackers Borrow Legitimate AI Infrastructure

A lawyer signs in on her firm’s genuine login page. An employee enters a code at “microsoft.com.” A developer pastes an API key into an authentic AI platform. In each case, the user has verified the signals security training traditionally emphasizes, yet the infrastructure remains part of the attack.

That is the central finding of KnowBe4’s October 2026 Phishing Threat Trends Report, which examines observed activity from April through September and projects trends through December. The report says attackers are increasingly borrowing legitimate infrastructure rather than building obviously fraudulent domains, using trusted cloud services, authentication systems, AI platforms and current events to make the premise of an attack appear credible.

The New Economics of Trust

The report describes phishing as an industrialized supply chain. Toolkit developers provide turnkey software, cloud providers supply infrastructure and operators route payloads into enterprise inboxes. Of 2.4 million phishing emails analyzed, more than 700,000 were traced to known and tracked toolkits.

Toolkit-based phishing represented 29.2% of malicious emails in the third quarter of 2026, compared with 18.9% in 2024, a reported 54% increase. Three toolkits—Sneaky 2FA, FlowerStorm and ONNX Store—accounted for 90.2% of attributed kit-driven phishing volume. Continuous automated services represented 20.7% of tracked operations but generated 91.3% of toolkit-driven phishing, while single-burst operations accounted for 43.1% of operations and only 2.2% of attributed volume.

The operational model is persistent rather than episodic. KnowBe4 tracked a median of 45 active toolkit operations sending mail daily, falling to 31 over weekends. The report also found that 25.6% of link-bearing email attacks in the third quarter contained some form of multi-factor authentication bypass capability.

Regional telemetry shows why global filtering baselines can miss local patterns. Germany recorded business email compromise in 79.2% of attacks, compared with 51.2% globally. The United Kingdom had malicious URLs in 74.1% of dangerous mail, against a 66.2% global baseline. South Africa recorded company impersonation in 64.1% of dangerous mail, while Singapore’s advance-fee fraud reached 24.4%, or 5.2 times the global average.

News Cycles as Attack Infrastructure

Current events give attackers a ready-made credibility layer. The report says threat actors responded to headlines 5.4 times faster in 2026 than in 2022. Breaking-news campaigns could appear within hours: lures themed around Dolly Parton’s death circulated in under 16 hours, while attacks following the Kumamoto earthquake appeared within 49 hours.

Planned events provided a longer runway. FIFA World Cup lures began 68 days before the June 11 opening match and used at least nine themes, including ticket discounts, watch parties, merchandise giveaways and streaming access. Planned-news campaign duration increased 138% in 2026, while breaking-news campaigns ended 4.8 times faster. The report says 87.9% of attacks tied to planned coverage and breaking news included impersonation of a globally recognized brand.

These threat actors are getting quicker. So far in 2026, attackers are 5.4 times faster when responding to headlines than they were in 2022.

—James Dyer, Head of Threat Intelligence, KnowBe4

The report’s examples include a Japanese Red Cross impersonation after the Kumamoto earthquake, using a PayPay donation request. The campaign’s domain was registered one day earlier, and the fraudulent QR code was inserted through an email table to bypass security filters.

Permission Theft Moves Beyond Passwords

Authentication phishing changes the remediation problem. Instead of stealing a password, attackers use legitimate identity systems to induce users to authorize access. Device-code abuse exploits OAuth 2.0 flows originally designed for devices without interactive browsers. The victim visits a genuine verification endpoint, enters a code supplied by the attacker and completes authentication, including any required MFA. The authorization server then issues access and refresh tokens to the attacker’s session.

The report observed device-code abuse in 2% of link-based phishing attacks originating from phishing toolkits in the third quarter of 2026. Refresh tokens may persist for 90 days or more. Similarly, malicious OAuth consent grants can provide delegated access to mailboxes, files and calendars; changing a password does not necessarily revoke those grants. Remediation requires explicit administrative token revocation.

The same permission problem applies to AI agents. If an attacker obtains an API key associated with an agent, the key can provide access across connected systems, data pipelines and third-party integrations. The report says stolen keys can expose system prompts, production data and downstream applications, while agent permissions may operate without ordinary MFA prompts or session expiration.

AI Platforms Become Phishing Hosts

KnowBe4 reports that an attack was twice as likely to originate from legitimate infrastructure in the third quarter of 2026. Attackers used AI platforms, including “claude[.]ai” and “chatgpt[.]com,” to host fake developer consoles, sign-in prompts, download hubs and usage alerts.

One case involved Claude Artifacts, a native feature for generating and executing self-contained web content on the official Claude domain. The report says threat actors used the feature to render credential harvesters and download portals on legitimate AI infrastructure. The genuine domain and valid certificate could cause both reputation filters and user checks to pass.

In July 2026, KnowBe4 Defend analyzed a 6.6x surge in attacks prompting users to update packages. The report links a key portion of that activity to Fable model attacks following a temporary pause in the model’s release by the U.S. government. Between April and August 2026, AI-brand impersonation attacks rose 228%; AI-themed subject lines grew eightfold and AI-brand lookalike links doubled.

The fraud was in the premise: they were authorizing the attacker’s access, not their own.

—James Dyer, Head of Threat Intelligence, KnowBe4

What Enterprise Security Teams Must Reconsider

The report’s data points to a shift from domain reputation and visible login-page fraud toward behavioral and permission-aware controls. A genuine URL, valid certificate, trusted cloud provider or verified publisher badge does not establish that the requested action is safe.

Security teams will need to account for device-code flows, OAuth grants, refresh-token persistence and API-key exposure in incident response. Password resets alone may leave unauthorized access active. AI platform traffic also requires closer scrutiny because background scripts, connectors and routine model interactions can mask malicious activity.

KnowBe4 projects increased legitimate-platform hijacking involving document-signing platforms in October. It expects November e-commerce attacks tied to Black Friday and continued e-commerce exploitation into December, alongside more HR impersonation related to salary increases. The report’s broader conclusion is that phishing defenses must assess identity, authorization, platform behavior and regional targeting—not only whether a message contains a suspicious domain.