Targeted work: why scammers are using phishing more often
Hackers have become more likely to use phishing to deceive Russians, experts have warned about this. In the first half of 2026, the share of this type of fraud in illegitimate (dangerous) mail traffic increased by 11.6% compared to the same period in 2025, while the share of other threats decreased. For more information about why scammers are increasingly using phishing, how dangerous it is and how to protect themselves from such threats, see the Izvestia article.
What is known about the growing popularity of phishing
BI.ZONE Mail Security specialists told Izvestia that in the first half of 2026, the share of phishing in illegitimate (dangerous) mail traffic increased by 11.6% compared to the same period in 2025.
Phishing is a type of social engineering. Attackers disguise an email as a legitimate source in order to force a person to give out confidential information, such as entering a username, password, confirmation code, or other data. In corporate attacks, phishing is also used as a way to initially penetrate the infrastructure of companies.
According to BI.ZONE Mail Security, in the first half of 2026, this type of attack accounted for 90% of illegitimate mail traffic (9 out of 10 mail threats) against 80.7% a year earlier. This trend has been observed in most industries. The share of phishing, in particular, increased in healthcare by 1.4 times, in insurance by 1.2, in industry and logistics by 1.1. At the same time, the share of other threats, on the contrary, decreased: for example, among emails with malicious attachments — from 1.8% to 1.0%.
According to experts, phishing remains an effective method of compromise, as it allows attackers to transfer the attack to an environment controlled by them. The employee ends up on a fake page, where he enters credentials or performs the necessary action. Attacks using malicious software are more difficult: cybercriminals have to operate directly in the company's infrastructure, where antiviruses and other security tools are running.
Why phishing has become more popular with scammers
The growing popularity of phishing is due to the fact that it is becoming cheaper and easier to scale, says Anastasia Hveschenik, product Manager of Solar WebProxy at Solar Group. According to the expert, attackers use ready-made infrastructure for mailing lists and creating phishing pages, and large phishing networks can include tens of thousands of fake sites.
—Artificial intelligence (AI) additionally simplifies the preparation of emails and phishing pages, as well as the first contacts with a potential victim,— the Izvestia interlocutor clarifies. — First of all, it speeds up processes that are already familiar to intruders.
Now it has become easier and cheaper to prepare a phishing campaign, agrees Nikita Sinkevich, incident response expert at Angara MTDR. Ready-made kits are provided using the phishing as a service model, and generative AI helps you quickly create literate and personalized emails in different languages. At the same time, attackers often do not need to infect a computer: it is enough to steal credentials, a token of an active session, or to obtain login confirmation by the user himself.
At the same time, phishing campaigns are becoming more regulated: according to Dmitry Tsarev, head of the BI.ZONE cloud cybersecurity solutions department, ready-made mailing platforms are already being sold on the darknet, which allow you to create email templates, control sending and check whether messages end up in spam. At the same time, mail remains an initial access method for attackers with different motivations and goals.
According to the BI.ZONE Threat Intelligence cyber intelligence portal, the number of groups using email for initial access increased by 4.8% year-on-year in the first half of 2026. At the same time, the composition of existing clusters has changed: nine of those that were active in 2025 were not noticed in 2026, and 10 new ones are attacking via email. For example, the Clubfoot Wolf cluster uses email in financially motivated attacks, Vortex Werewolf and Eagle Werewolf in campaigns against government and defense sector organizations, and Insolent Hyena for hacktivist activity.
Which phishing schemes are popular in 2026
Using phishing in 2026, attackers most often steal credentials under the guise of regular work correspondence, Nikita Sinkevich points out. These can be notifications about a document, invoice, vacation, salary, electronic signature, mail blocking, or the need to change the password. The link leads to a copy of a Microsoft 365, Outlook, SharePoint, or corporate portal page.
— QR phishing (quishing) is a separate area, — the Izvestia interlocutor notes. — The code is placed directly in an email or PDF document and offered to be scanned to view the file, confirm your account, or re-authorize.
After scanning, the user gets to the fake page from a smartphone, which may be located outside the corporate protection circuit, the specialist notes. In addition, chains of several stages are used: the letter leads to a CAPTCHA, an intermediate page, or a legitimate cloud service, and then to a phishing resource. This helps to hide the destination address from automatic verification tools. At the same time, schemes with fake requests from the head or counterparty persist in the corporate segment: urgent calls to pay the bill, change bank details, provide documents or employee information. However, the email is not necessarily sent from a fake address — fraudsters may use a previously compromised mailbox of a real employee or partner.
— Mass mailings are designed for a wide audience: it is enough for an attacker to have a small part of the recipients respond to the letter, — says Anastasia Hveschenik. — In a corporate environment, the target is employees, through whose accounts you can access the company's internal services.
A common target of such attacks is the theft of credentials, the expert says. A person enters a username, password, and confirmation code on a phishing page, and the attacker immediately uses them to log into the real service. This way you can bypass two-factor authentication if the user has submitted the code himself. One stolen account can become an entry point into the company's infrastructure. Attackers can use the information they receive about employees and internal processes for the following attacks.
How to protect yourself from phishing attacks by scammers
In order to protect against phishing attacks in 2026, experts interviewed by Izvestia advise following certain security rules. In particular, Anastasia Khveschenik recommends checking the sender's address and domain before clicking on the link. The official address of the organization can be found through a search engine and compared with what is indicated in the letter.
"The attackers use addresses similar to the real ones: they replace letters with similar symbols, add words or hyphens," the expert draws attention. — If the letter raises doubts, it is better to confirm the information through another communication channel, for example, to call the sender.
Urgency, pressure, requests to follow a link, download a file, enter a password or a confirmation code should alert, adds Anastasia Hveschenik. At the same time, a legitimate address also does not guarantee security, since the sender's account could have been compromised. As for companies, Sergey Polunin, head of the Gazinformservice IT Infrastructure Solutions protection group, urges not to think that the solution to the phishing problem lies solely in employee training.
— Of course, people often turn out to be the weakest link in fraudulent schemes, but considering the attentiveness of a conditional accountant or sales manager as a means of protection, according to the editorial interlocutor, is a "fatal assumption." In fact, businesses need layered protection — modern mail filtering tools, two-factor authentication for critical services, a hardware key, and normal workstation protection. It is training and "foolproof" that provide the most synergistic effect," concludes Sergey Polunin.
Переведено сервисом «Яндекс Переводчик»
