KnowBe4 Report Tracks Rising Teams, Calendar and Reverse-Proxy Phishing
Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.
Summary
KnowBe4’s April 2026 report records a 41% rise in Teams attacks and a 49% increase in calendar phishing over six months. Its telemetry also highlights growing reverse-proxy use and abuse of compromised accounts.
Key points
- The report draws primarily on KnowBe4 Collaboration Security product data, including Q1 2026 campaign observations.
- KnowBe4 reports a 41% increase in Teams-based attacks from October 2025 to March 2026; 17.38% of Teams attacks began in email before moving to chat.
- Calendar-invite phishing increased 49% over six months. One analyzed attack abused Google Calendar notifications and a university-site open redirect to conceal a credential-harvesting destination.
- Reverse-proxy attacks rose 139.22% from September 2025 to March 2026 in KnowBe4’s dataset. These attacks relay legitimate logins while capturing credentials and authenticated session cookies to bypass MFA.
- KnowBe4’s data suggests approximately 85.8% of phishing attacks used AI in some form over the preceding six months; polymorphic elements appeared in 67.3% of attacks in 2026, versus 56.9% in 2024.
- The report says 61.2% of phishing emails that bypassed security gateways originated from compromised accounts, illustrating the limitations of sender-reputation and authentication checks alone.
- Actor profiles describe contrasting evasion strategies: Tektite Vulture uses concentrated bursts and clickable-image lures, while Sulphur Kestrel uses aged domains, reverse proxies, and VPN-aware redirects.
Article Details
- Publisher
- KnowBe4
- Report Period
- 2026-01-01 to 2026-03-31
- Scope
- Phishing activity observed through KnowBe4 Collaboration Security products, including actor attribution, Teams attacks, reverse-proxy phishing, AI-enabled threats, and calendar invitations; includes historical comparisons.
- Key Statistics
- KnowBe4 reports a 41% increase in Teams-based attacks between October 2025 and March 2026.
- Reverse-proxy attacks increased by 139.22% between September 2025 and March 2026 in the researchers' dataset.
- KnowBe4's data suggests that 85.76% of phishing attacks used AI in some form during the preceding six months.
- Calendar-invite phishing increased by 49% over the preceding six months.
- Among phishing emails successfully bypassing security gateways, 61.2% came from compromised accounts; 11.4% of those compromised accounts were trusted supply-chain accounts.
- Recommendations
- Verify login-page URLs for subtly altered domains before entering credentials.
- Analyze incoming and outgoing network traffic for signs of malicious intermediary proxy connections.
- Base detection on attacker behaviors and operational tactics rather than relying solely on disposable indicators or domain reputation.
- Extend human risk management and phishing awareness to collaboration platforms and calendar invitations.
- Begin security training immediately for new employees and provide continuous, automated coaching.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationSulphur Kestrel uses JavaScript and split/reverse obfuscation to fragment malicious code and evade static analysis.T1027.006 · HTML SmugglingThe report identifies HTML smuggling as a technique used to bypass security vendors.T1036 · MasqueradingTektite Vulture impersonates internal IT and DocuSign workflows, using display-name stuffing to obscure the actual sender address.T1219 · Remote Access ToolsThe IT-impersonation case study describes attackers persuading victims to grant remote desktop control during a call.T1539 · Steal Web Session CookieReverse-proxy phishing captures authenticated session cookies for subsequent account takeover.T1550.004 · Web Session CookieAttackers use stolen authenticated session tickets to access accounts without completing MFA themselves.T1557 · Adversary-in-the-MiddleAiTM phishing places an attacker-controlled reverse proxy between victims and legitimate login services to intercept credentials and authenticated sessions.T1566.001 · Spearphishing AttachmentThe report describes phishing attachments, including PDFs, SVGs, DOCX files, and calendar invitations carrying malicious links.T1566.002 · Spearphishing LinkAttackers send malicious links leading to credential-harvesting pages and reverse-proxy phishing infrastructure.T1566.003 · Spearphishing via ServiceAttackers use Microsoft Teams messages to reinforce email lures and deliver malicious payloads.
People
Cameron SweeneyKnowBe4 Cyber Security Threat Researcher and report contributor who reverse engineers phishing attacks and malware.Dr. Martin J. KrämerKnowBe4 CISO Advisor and report contributor with a focus on human-centered computing.Jack ChapmanKnowBe4 SVP of Threat Intelligence; introduces the report and oversees threat research and AI development for KnowBe4 Defend.James DyerKnowBe4 Head of Threat Intelligence; provides analysis of campaign timing, phishing toolkits, and the cybercrime-as-a-service market.Louis TileyKnowBe4 Cyber Security Threat Researcher and report contributor who researches attack vectors and automates threat intelligence gathering.Lucy GeeKnowBe4 Cyber Security Threat Researcher and report contributor who analyzes phishing campaigns and behavioral insights.
Threat Actors
Amber ShearwaterKnowBe4 attributes this group to Latvia and reports high-velocity, short-duration campaigns involving Temu e-commerce fraud.Basalt HarrierKnowBe4 attributes this group to USA and reports 294 campaigns involving generic e-commerce fraud in Q1 2026.Laterite MagpieKnowBe4 attributes this group to Nigeria and associates it with BEC and Microsoft impersonation.Sulphur KestrelKnowBe4 lists its origin as Indonesia/Singapore and describes Microsoft 365 credential harvesting, reverse-proxy MFA bypass, calendar-invite lures, and use of Greatness or NakedPages.Tektite VultureKnowBe4 attributes this financially motivated group to Vietnam; reports credential harvesting, invoice fraud, DocuSign impersonation, and validated use of the Typhoon Phishing Kit.
Vendors
Products
Google Calendar• Primary Delivery: The attacker abuses legitimate Google Calendar notifications to ensure DMARCKnowBe4 DefendThis is a real-world example of a phishing email reported in the KnowBe4 Defend platform, part of a campaignMicrosoft 365 Apps for Enterprisespecializing in high-fidelity Microsoft 365 and Procedures (TTPs):Microsoft TeamsThis report dives deep into the diverse trust gap associated with Microsoft Teams?Workdayemployees when they are likely fatigued and less scrutinizing as they wrap up their workday.Zoomattacker to respond to queries in real-time. X Zoom Call
Tools
Evilginxand is leveraged by a wide range of threat actors. Popular tools demonstrating this method include Evilginx,FraudGPTFraudGPT (Lifetime)GreatnessKey Tooling: Expert utilization of the GreatnessKratosKratos ModlishkaModlishkaModlishka, and Muraena. For instance, the threat group Sulphur Kestrel expertly leverages this AiTM architecture,MuraenaModlishka, and Muraena. For instance, the threat group Sulphur Kestrel expertly leverages this AiTM architecture,NakedPagesor NakedPages Phishing-as-a-Service (PhaaS)WormGPT 4| noitacitsihpoS noisavE | WormGPT 4 | | | | |Xanthorox AI| | Xanthorox AI (Xen) | $3,000 | | | |