Phishing has been around for decades. The basic idea has remained simple: trick a person into doing something that benefits the attacker.
But the phishing attacks we have seen during 2026 show that the technique is changing significantly.
The obvious signs of phishing are becoming less obvious. Attackers are using artificial intelligence to create more convincing messages, legitimate authentication mechanisms to bypass traditional defences, QR codes to move attacks from email to mobile devices, and increasingly sophisticated social engineering to exploit trust.
For organizations, this creates a simple problem: the phishing awareness rules employees learned a few years ago may no longer be enough.
Phishing No Longer Means “Give Me Your Password”
One of the clearest examples we have seen in 2026 is the growth of device-code phishing.
Microsoft documented a large-scale campaign in April where attackers abused Microsoft’s legitimate device-code authentication flow. Instead of asking the victim to enter a password into a fake Microsoft login page, the attacker initiated an authentication request and convinced the victim to enter a code at Microsoft’s legitimate device-login page.
The result was that the attacker could obtain an authentication token and access the account without directly stealing the user’s password. Microsoft described the campaign as being supported by automation and AI-generated, highly targeted phishing lures.
This is an important change.
An employee can check the URL, see microsoft.com, complete an MFA-backed authentication process and still be participating in a phishing attack.
AI Is Making Social Engineering More Personal
Another clear development in 2026 is the use of AI to improve the quality and scale of phishing campaigns.
Attackers are no longer limited to poorly written messages containing obvious spelling mistakes and generic requests. Microsoft observed AI-generated phishing emails tailored to the victim’s role, including themes involving invoices, RFPs and business workflows.
In September 2026, Microsoft reported on EvilTokens, a phishing-as-a-service platform that uses AI capabilities to help tailor phishing lures and analyze compromised mailboxes. The platform was associated with compromises involving more than 12,000 inboxes across over 10,000 organizations.
The implication for awareness programs is significant.
Telling employees to look for poor grammar, strange formatting or obviously suspicious requests is becoming less useful. A well-crafted phishing message can now look like something that genuinely belongs in an employee’s normal working day.
Phishing Is Moving Beyond the Inbox
The other major lesson from 2026 is that phishing is no longer restricted to traditional email links.
QR-code phishing has grown significantly. Microsoft reported that QR phishing volumes increased from 7.6 million attacks in January 2026 to 18.7 million in March — a 146% increase during the quarter.
The attraction for attackers is obvious. A QR code can move the victim from a corporate email environment to a personal mobile device, where many of the organization’s email and web security controls no longer apply in the same way.
We are also seeing greater use of voice-based social engineering. Mandiant’s 2026 M-Trends report found highly interactive voice phishing accounted for 11% of observed intrusions in its 2025 investigations, making it a significant initial access technique.
The lesson is that phishing awareness cannot simply mean “check links in emails.”
It has to address human decision-making across email, authentication, messaging, voice and mobile interactions.
In 2026, Trust Is Becoming the Attack Surface
The common thread across these attacks is not technology.
It is trust.
- A Microsoft authentication request
- An internal compliance notification
- A document-sharing request
- A QR code
- An urgent business request
- A message apparently coming from a trusted service
Microsoft documented a 2026 campaign that targeted more than 35,000 users across over 13,000 organizations. The messages were disguised as internal compliance or regulatory communications and used documents and links to initiate credential theft. Financial services represented 18% of the targeted industries.
“In 2026, the most dangerous phishing attack may not look suspicious at all. It may look like something your employee does every day.”
This is why cybersecurity awareness needs to evolve.
Training Alone Cannot Test This
Security awareness training remains important. Employees need to understand phishing, social engineering, authentication risks and safe reporting procedures.
But training answers one question:
What does the employee know?
A phishing simulation answers a different question:
What does the employee actually do?
That distinction is becoming increasingly important.
If today’s attacks use realistic business scenarios, legitimate authentication pages, QR codes, AI-generated messages and highly personalized requests, organizations should test employees against realistic scenarios as well.
What Organizations Should Be Doing Differently
- Run phishing simulations periodically
- Use different scenarios rather than repeating the same template
- Test current attack techniques
- Target different departments and risk groups
- Measure both clicking and reporting behaviour
- Provide targeted education after failures
- Retest employees to measure improvement
- Track trends over time rather than relying on one campaign result
The objective is not to catch employees.
The objective is to discover weaknesses while the attack is simulated rather than after a real attacker has discovered them.
From Awareness to Measurable Behaviour
This is where platforms such as Trust Habit become useful.
Trust Habit allows organizations to conduct realistic phishing simulations, target specific employee groups, measure responses, identify vulnerable users and track improvement across campaigns.
The technology does not replace security awareness training.
It adds the missing measurement layer.
Train → Simulate → Measure → Educate → Retest
That cycle is increasingly relevant because phishing itself is changing rapidly.
The attacks we have seen in 2026 demonstrate that employees are no longer simply being asked to identify an obviously fake email. They are being asked to make security decisions in situations that can look completely legitimate.
The 2026 Lesson
Phishing has not disappeared. It has become more convincing, more automated and more deeply integrated into the tools and workflows employees already trust.
The response cannot simply be more training content.
Organizations need to continuously test whether employees can recognize and respond to deception when it looks legitimate.
Because the real question is no longer:
“Do our employees know what phishing is?”
It is:
“Will they recognize and report the next phishing attack?”