Topic starter
27/06/2026 1:44 pm
TL;DR: Phishing accounted for 58% of nearly 800,000 observed email attacks across 4,600+ organisations, with attackers increasingly using redirect chains, link shorteners, file-sharing lures, and brand impersonation to blend into normal workflows, according to Abnormal AI. Static awareness training is no longer enough when the attack pattern is calibrated to routine behaviour rather than obvious errors.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “2026 Attack Landscape Report: Phishing Tactics Calibrate to Your Environment”.
By the numbers:
- Phishing represents 58% of nearly 800,000 observed attacks across 4,600+ organisations.
- File-sharing phishing hits financial services at 22.2% and construction at 21.3%.
- Brand impersonation reaches 24.1% in hospitality, more than double the 12% sample average.
Key questions
Q: How should security teams reduce phishing risk when attacks blend into normal work?
A: Treat phishing as a workflow and trust problem, not only an email-filtering problem.
Q: Why do link shorteners make phishing harder to stop in enterprise environments?
A: Link shorteners hide the final destination behind a trusted-looking intermediate URL, which weakens reputation checks and slows inspection.
Q: What are the warning signs that phishing is targeting a specific industry workflow?
A: Messages that imitate the collaboration tools, document services or branded platforms common in a sector are a strong clue.
Practitioner guidance
- Map the organisation's routine trust surfaces Inventory the branded platforms, document-sharing tools, payment flows and notification paths employees see most often, then prioritise those surfaces for phishing controls and detection tuning.
- Tune URL inspection for redirects and shorteners Treat multi-hop URLs, shortener services and trusted redirect domains as high-risk signals, especially where attackers can hide behind reputable infrastructure.
- Align awareness training to actual workflows Replace generic phishing examples with examples drawn from the organisation's real collaboration, document exchange and SaaS login patterns so users learn to question routine-looking messages.
Bottom line: Phishing is succeeding by mirroring the work patterns people already trust, which weakens security approaches built around spotting obvious mistakes.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:09 pm
Phishing has become a workflow conformity problem, not just a human error problem. The article shows that attackers are matching lures to the tools and routines employees already trust. That shifts the security question from whether users are careless to whether identity and messaging controls can distinguish routine from manipulated routine. For practitioners, the implication is that behaviour-aware controls now sit alongside training as a core line of defence.
A few things that frame the scale:
- Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.
A question worth separating out:
Q: What happens when organisations try to stop phishing with awareness training alone?
A: Awareness training alone leaves a major gap because phishing attacks change faster than user behavior does. Users may recognise generic scams, yet still miss impersonation, supplier fraud, and credential theft. Without layered controls, one successful message can lead to account compromise, data breach, or ransomware, while IT teams absorb extra remediation work after the fact.
👉 Read our full editorial: Phishing adapts to enterprise workflows, not just employee mistakes