Topic starter
02/08/2026 11:41 am
TL;DR: Phishing is spreading into Microsoft Teams, calendar invites, prompt injection, and DMARC evasion, Knowbe4 found in its 2026 Phishing Threat Trends Report. Security programmes now need to govern trust across channels and sessions, not just at email authentication.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “2026 Phishing Threat Trends Report, Vol. 7”.
By the numbers:
- Microsoft Teams attacks have surged by 41% in just six months.
- Calendar invite phishing has increased by 49% as attackers move into scheduling workflows.
- 84.4% of all successful phishing attacks now pass DMARC.
Key questions
Q: Why do social engineering attacks spread so easily across collaboration tools and email?
A: They work because these platforms are trusted for routine business interaction, which lowers user suspicion and helps attackers blend malicious messages into normal workflows.
Q: How should security teams handle prompt injection in inbox assistants?
A: Treat inbox assistants as part of the attack surface, not just productivity tools.
Q: What breaks when MFA can be proxied through a reverse proxy?
A: What breaks is the assumption that completing MFA proves the session is trustworthy.
Practitioner guidance
- Extend phishing governance to collaboration platforms Include Microsoft Teams, calendar invites, and other internal messaging tools in phishing monitoring, user reporting, and content inspection workflows.
- Harden MFA against relay and session theft Add controls that detect reverse-proxy behaviour, suspicious token reuse, and impossible session transitions, then enforce conditional access responses.
- Review AI-assisted inbox tools for manipulation risk Assess whether summarisation, drafting, or routing assistants can be influenced by prompt injection or hostile content that changes what users see.
Bottom line: Phishing is expanding into collaboration tools, calendar workflows, and AI-assisted inbox systems, which means traditional email-only controls no longer cover the full attack surface.
Glossary terms: Reverse Proxy MFA Bypass, Prompt Injection (Agentic), Channel trust boundary, Session Governance
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 12:53 pm
AI-assisted phishing is now an identity governance problem, not just a user-awareness problem. When attackers can manipulate AI systems that summarise or route communications, the trust boundary moves from the inbox to the decision layer. That means security teams must account for how humans, machines, and AI intermediaries all participate in message trust. The practical conclusion is that identity assurance has to cover the workflow, not only the login.
A few things that frame the scale:
- Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.
A question worth separating out:
Q: Should organisations rely on DMARC to stop phishing?
A: No. DMARC helps reduce spoofing, but it does not stop attacks that use valid infrastructure, collaboration channels, or post-delivery manipulation. Organisations should keep DMARC in place, but measure phishing resilience across the whole delivery chain, including session abuse, channel trust, and user action after delivery.
👉 Read our full editorial: Phishing trends show AI agent abuse and MFA bypass scaling fast