Phishing has surged back to the top of the attacker playbook, and AI is a major reason why.
According to Cisco Talos’ IR Trends Q1 2026 report, phishing reemerged as the most observed initial access vector in incident-response engagements. Talos found that phishing accounted for over a third of cases where the initial access method could be determined, while valid accounts accounted for 24% and exploitation of public-facing applications dropped to 18% in Q1 2026.
The message for defenders is clear: attackers are not only exploiting software vulnerabilities — they are increasingly exploiting people, identity, and trust.
Why AI Is Changing Phishing
AI has made phishing faster, cleaner, and more scalable.
Attackers can now generate convincing email lures in multiple languages, personalize messages for specific roles, and quickly adjust wording between campaigns. This makes phishing harder for both humans and traditional email filters to detect.
Cisco Talos’ Nick Biasini explained that attackers now have the ability to create convincing phishing emails in a wide range of languages, and this is starting to appear clearly in incident-response data.
The old warning signs — poor grammar, strange formatting, awkward language — are becoming less reliable.
Phishing Numbers Are Rising Again
Cisco Talos reported that phishing replaced exploitation of public-facing applications as the top initial access method in Q1 2026. This is notable because exploitation had dominated during recent quarters, partly due to the widespread exploitation of Microsoft SharePoint “ToolShell” vulnerabilities. Talos observed public-facing application exploitation decrease from a high of 62% to 18% in Q1 2026.
This does not mean vulnerability management is no longer important. It means attackers are shifting back toward a lower-friction path: stealing access instead of breaking in through a technical exploit.
AI-Generated Phishing Is Becoming Normal
Hoxhunt’s 2026 phishing trends research also shows a sharp rise in AI-generated phishing. The company reported that AI-generated phishing attacks bypassing email filters surged 14x at the end of 2025, rising from 4% to 56% of reported attacks across its global network during the holiday season. Hoxhunt also noted that this trend continued into 2026.
These attacks are not necessarily futuristic deepfake campaigns. In many cases, they are simply more polished versions of familiar phishing messages: better grammar, cleaner design, more believable timing, and more relevant wording.
That is enough to make them dangerous.
Identity Is the Real Target
Modern phishing is often less about delivering malware and more about stealing identity.
Attackers want valid credentials, session tokens, MFA approvals, OAuth access, or access to trusted accounts. Once they have a real account, they can move through an environment more quietly and blend into legitimate activity.
Dark Reading reported that Cisco Talos and KnowBe4 have both seen increased phishing targeting privileged users such as system administrators, executives, and accounting teams.
This makes sense. A compromised admin, finance user, or executive mailbox can be far more valuable than a compromised low-privilege account.
MFA Is Critical — But Not Enough
Multifactor authentication remains essential, but organizations should not assume MFA alone solves the problem.
Cisco Talos reported that 35% of Q1 2026 engagements involved MFA weaknesses. These included cases where MFA was missing, only partially enabled, bypassed, or abused through device registration and authentication workflow gaps.
Attackers are no longer only trying to steal passwords. They are also trying to bypass or manipulate the identity systems around those passwords.
Common weaknesses include:
- 🔓 incomplete MFA coverage
- 📱 attacker-controlled MFA device registration
- 🧾 stolen session tokens or cookies
- 📨 phishing pages that proxy authentication flows
- 🧑💼 compromised trusted accounts used for internal phishing
Legitimate Services Make Phishing Harder to Spot
Another major challenge is the abuse of legitimate platforms.
Attackers increasingly hide malicious links or messages inside trusted services such as cloud tools, collaboration platforms, file-sharing services, CRM systems, and electronic signature platforms. Dark Reading noted examples such as Gmail, DocuSign, Outlook, and Salesforce being abused to make phishing emails appear more legitimate.
This makes detection harder because users are no longer only looking for obvious suspicious domains. A phishing link may appear inside a notification from a trusted platform, or the email may pass authentication checks such as DMARC.
The phishing message may look legitimate because part of it really is coming from a legitimate service.
Polymorphic Phishing: Every Message Looks Different
AI also enables what is often called polymorphic phishing.
Instead of sending the same email to hundreds of people, attackers can generate many slightly different versions of the same lure. Subject lines, wording, formatting, call-to-action text, and payload links can vary from message to message.
This makes detection harder because security tools cannot rely only on matching one known malicious template. It also makes awareness training harder because employees may not all see the same example.
The phishing campaign becomes a moving target.
How Organizations Should Respond
Defending against AI-powered phishing requires a layered approach.
Security teams should focus on:
- ✅ strong MFA with controlled device registration
- ✅ phishing-resistant MFA where possible, such as FIDO2/security keys
- ✅ Conditional Access based on device, location, risk, and session context
- ✅ monitoring for impossible travel, unusual mailbox rules, and suspicious logins
- ✅ alerting on new OAuth consent grants and suspicious app registrations
- ✅ blocking legacy authentication and unprotected protocols
- ✅ improved email security with link rewriting and attachment sandboxing
- ✅ rapid credential and session token revocation playbooks
- ✅ security awareness training based on current real-world lures
- ✅ internal reporting workflows that make suspicious emails easy to report
Cisco Talos specifically recommends properly configured MFA and centralized authentication controls, including restricting self-service MFA enrollment.
What Employees Should Remember
A simple awareness message for users:
🚨 Do not trust an email just because it looks professional, has perfect grammar, or appears to come from a known platform. Verify unexpected login prompts, payment requests, document links, and MFA approvals through a trusted internal channel.
The classic signs of phishing are changing. The safest habit is verification.
Final Thoughts
AI is not inventing phishing. It is making phishing faster, cleaner, more personalized, and harder to detect.
Attackers are using AI to scale social engineering, target privileged users, abuse legitimate services, and generate polished messages that no longer look suspicious at first glance.
🎯 Phishing is no longer just an email problem. It is an identity, trust, and access problem.
Organizations need to respond accordingly: stronger identity controls, better monitoring, faster response playbooks, and user training that reflects how modern phishing actually looks.
