Topic starter
02/08/2026 11:41 am
TL;DR: Microsoft Teams attacks rose 41% in six months, calendar invite phishing increased 49%, prompt injection can reduce time-to-compromise to four seconds, and 84.4% of successful phishing now passes DMARC, according to Knowbe4’s 2026 Phishing Threat Trends Report. The findings show identity verification, inbox trust, and MFA assumptions are all being industrialised faster than many security programmes can adapt.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “2026 Phishing Threat Trends Report, Vol. 7”.
By the numbers:
- Microsoft Teams attacks have surged by 41% in just six months.
- Calendar invite phishing has increased by 49% as attackers move into scheduling workflows.
- 84.4% of all successful phishing attacks now pass DMARC.
Key questions
Q: What breaks when MFA can be proxied through a reverse proxy?
A: What breaks is the assumption that completing MFA proves the session is trustworthy.
Q: Why do social engineering attacks spread so easily across collaboration tools and email?
A: They work because these platforms are trusted for routine business interaction, which lowers user suspicion and helps attackers blend malicious messages into normal workflows.
Q: How should security teams handle prompt injection in inbox assistants?
A: Treat inbox assistants as part of the attack surface, not just productivity tools.
Practitioner guidance
- Extend phishing governance to collaboration platforms Include Microsoft Teams, calendar invites, and other internal messaging tools in phishing monitoring, user reporting, and content inspection workflows.
- Harden MFA against relay and session theft Add controls that detect reverse-proxy behaviour, suspicious token reuse, and impossible session transitions, then enforce conditional access responses.
- Review AI-assisted inbox tools for manipulation risk Assess whether summarisation, drafting, or routing assistants can be influenced by prompt injection or hostile content that changes what users see.
Bottom line: Phishing is expanding into collaboration tools, calendar workflows, and AI-assisted inbox systems, which means traditional email-only controls no longer cover the full attack surface.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:53 pm
AI-assisted phishing is now an identity governance problem, not just a user-awareness problem. When attackers can manipulate AI systems that summarise or route communications, the trust boundary moves from the inbox to the decision layer. That means security teams must account for how humans, machines, and AI intermediaries all participate in message trust. The practical conclusion is that identity assurance has to cover the workflow, not only the login.
A few things that frame the scale:
- Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.
A question worth separating out:
Q: Should organisations rely on DMARC to stop phishing?
A: No. DMARC helps reduce spoofing, but it does not stop attacks that use valid infrastructure, collaboration channels, or post-delivery manipulation. Organisations should keep DMARC in place, but measure phishing resilience across the whole delivery chain, including session abuse, channel trust, and user action after delivery.
👉 Read our full editorial: Phishing trends show AI agent abuse and MFA bypass scaling fast