Loading story…
Pistachio’s 2026 Phishing Behaviour Report, based on 2.47 million simulated phishing attempts involving more than 123,000 employees across over 1,200 organizations, found that email click rates alone do not reliably measure phishing resilience. The company recommends tracking clicks alongside credential submissions and employee reporting, as a click does not necessarily result in account compromise and may still be followed by a report. In sustained programs, click and credential-leak rates initially rose as simulations became more frequent and difficult, then declined; from the six-month peak to 12 months, clicks fell 27% and credential leaks fell 41%, while the report-to-click ratio increased from 1.3 to 1.8.
Risk differed sharply by industry and function. Construction recorded the highest cumulative click and credential-leak rates, with nearly 20% of construction and real-estate employees submitting credentials after a successful simulation; financial services was the most resilient, while healthcare had the lowest reporting rate. Technical roles were not inherently safer: 30.27% of technology-development employees and 28.53% of IT employees clicked at least one simulated phishing message. Organizations should use multi-metric, department-level measurement and maintain long-term training programs rather than judging awareness solely on short-term click-rate reductions.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Pistachio's reported analysis period ended after examining phishing simulations conducted from June 1, 2025, through May 31, 2026. The complete-record journey analysis included 354,962 simulations across 648 organizations and 123,692 users.
Pistachio's analysis period began with simulated phishing attempts sent to employees through its AI-driven training platform, including email and Microsoft Teams. The study ultimately covered more than 123,000 users and more than 1,200 organizations, while a 648-organization subset had complete 12-month records.
Pistachio published its Phishing Behaviour Report 2026, concluding that phishing resilience should be measured through clicks, credential submissions, and suspicious-message reporting rather than click rates alone. The report found that clicks and credential leaks rose during the first six months before declining later, while reporting relative to clicks improved over 12 months.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcesecurityweek.com
Open sourcehelpnetsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Arctic Wolf 2025 Human Risk Behavior Snapshot: 2nd Edition highlights a significant disconnect between organizational confidence in cybersecurity and the reality of human-driven risk. The report, based on a survey of over 1,700 IT leaders and end users, reveals that 68% of organizations experienced a breach in the past year, marking an 8% increase from the previous year. Despite this rise in breaches, three-quarters of IT leaders maintain the belief that their organizations are safe from phishing attacks, a perception not supported by incident data. The FBI IC3 reported that over $6.3 billion was lost to business email compromise (BEC) scams in 2024, with Arctic Wolf researchers attributing 72.9% of BEC cases to phishing. This suggests that phishing remains a persistent and effective attack vector, undermining organizational defenses. The report underscores that human error and risky behaviors, such as clicking on malicious links, continue to be major contributors to security incidents. Nearly two-thirds of surveyed leaders admitted to clicking on a malicious link, and one in five of those who did so experienced a negative outcome. The findings indicate that investments in sophisticated technical defenses are being undermined by the unpredictable nature of human behavior. Leadership overconfidence is identified as a critical vulnerability, as it leads to underestimation of the threat posed by social engineering and phishing. The report calls for a reassessment of security strategies to address the human element, emphasizing the need for ongoing security awareness training and realistic risk assessments. The data suggests that without addressing human factors, organizations will continue to face a high likelihood of breaches. The report also highlights the importance of bridging the gap between perceived and actual security posture, advocating for a more holistic approach to risk management. The findings serve as a warning that technology alone is insufficient to protect against evolving threats. Organizations are urged to foster a culture of security mindfulness and to implement controls that account for human fallibility. The report concludes that addressing the human element is essential for reducing breach rates and improving overall cybersecurity resilience.
Jun 29, 2026
Recent coverage emphasized that **phishing and social engineering via email** remain a primary initial access vector, with attackers increasingly blending into routine workflows (emails, meeting invites, and trusted SaaS notifications). TechTarget highlighted that user judgment is often the last control when filters fail, citing the *Microsoft Digital Defense Report 2025* claim that **28% of breaches** trace back to phishing/social engineering, and noting reports of spam relayed through **legitimate Zendesk domains/instances** (e.g., leveraging recognizable brands) to bypass filtering and drive credential theft or follow-on access. Separate reporting and guidance reinforced how attackers operationalize these patterns: The Hacker News described **Operation Nomad Leopard**, a spear-phishing campaign targeting Afghan government entities using government-themed decoys and a **GitHub-hosted ISO** that drops a **LNK** to execute a **FALSECUB** backdoor capable of remote command execution. Other items in the set were largely general best-practice or “common threats” explainers (password hygiene, generic threat overviews) rather than incident-specific intelligence, but they align with the same overarching risk theme: weak/reused passwords and routine email behaviors continue to enable account takeover and downstream compromise.
Jun 29, 2026
Threat actors are increasingly using **AI to industrialize phishing**, generating high volumes of near-unique emails and rapidly iterating lures, links, and attachments in ways that degrade the effectiveness of signature-based and gateway-centric controls. Cofense-reported telemetry cited in industry coverage indicates enterprises saw **one malicious email on average every 19 seconds during 2025**, with campaigns often reusing underlying infrastructure even as message content continuously mutates. Phishing sites are also becoming more adaptive, tailoring content and payload delivery based on the victim’s device and environment (e.g., different outcomes for Windows, macOS, and mobile), while collecting detailed browser and system attributes to support customization and evasion. This shift is driving executive concern and shaping security investment priorities for 2026, with broader industry reporting highlighting **AI-enabled attacks**, fraud, and phishing as top risks and positioning **AI-enabled security** as a key countermeasure to keep pace with adversaries’ automation. Separately, an opinion-focused piece argues that AI changes the “build vs. buy” calculus for security teams by enabling more internal tool development and altering what types of security products deliver value; however, it does not provide incident-specific or phishing-specific intelligence. Overall, the most actionable signal across the sources is the operational reality of AI-driven phishing volume, adaptive delivery, and evasion—reinforcing the need to prioritize resilient detection and response capabilities over static indicators alone.
Jun 29, 2026