Topic starter
11/11/2026 5:56 pm
TL;DR: Malicious and unwanted email now makes up one in three messages, according to Barracuda, while phishing accounts for 48% of malicious email and PhaaS underpins 90% of high-volume campaigns. Email security can no longer stop at delivery filtering because account takeover begins when a user trust signal becomes attacker access.
Editorial analysis by NHI Mgmt Group, based on content published by Barracuda: “2026 Email Threats Report”.
By the numbers:
- 34% of companies experience at least one account takeover incident every month.
- 48% of malicious email activity is phishing.
- 90% of high-volume phishing campaigns used phishing-as-a-service kits.
Key questions
Q: What are the signs that an email account takeover is underway?
A: Common warning signs include unusual login patterns, unfamiliar devices or browsers, shifts in writing style or tone, and attempts to bypass multi factor authentication.
Q: What are the signs that QR code based phishing is being used to bypass email defenses?
A: A common sign is a message that pushes the recipient to scan a QR code instead of clicking a visible link.
Q: How do phishing-as-a-service kits change email attack risk?
A: Phishing-as-a-service kits lower the skill and time needed to run large phishing campaigns by packaging templates, hosting and automation.
Practitioner guidance
- Harden phishing response with identity telemetry Correlate risky sign-ins, impossible travel, inbox rule changes and outbound anomalies so account takeover is contained quickly after initial access.
- Block or detonate high-risk attachment types Apply stricter handling to HTML attachments, PDFs and Microsoft 365 documents by inspecting embedded redirects, scripts and QR codes before delivery.
- Enforce phishing-resistant authentication where possible Use stronger MFA and session-aware access controls so stolen credentials or intercepted sessions are less useful to attackers.
Bottom line: Phishing-as-a-service has turned email abuse into a scaled access model that lowers attacker effort and raises campaign volume.
Glossary terms: Phishing-as-a-service, Account Takeover, Adversary-in-the-Middle (AiTM), QR Code Phishing
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
Phishing has become a credential supply chain, not a standalone lure. Barracuda's data shows the threat is now industrialised through PhaaS, which reduces attacker effort and increases campaign volume. That matters because defenders are not just filtering messages anymore, they are interrupting a repeatable access path into identity systems. The field should treat mailbox access as a privileged control surface, not a communications problem.
A question worth separating out:
Q: Why does mailbox compromise lead to lateral movement?
A: Mailbox compromise enables lateral movement because an attacker can read reset links, session tokens, shared credentials, and internal instructions, then use them to access other systems as that user. Compromised email also exposes contact chains and approval workflows, which help the attacker impersonate the account, pivot to SSO portals, and request additional access or password resets.
👉 Read our full editorial: Phishing-as-a-service drives rising email attacks and account takeover