APWG Reports 13.8% Rise in Phishing Attacks in Q1 2026
Summary
APWG’s Q1 2026 report counted 971,181 phishing attacks, up 13.8% from Q4 2025. Telecom was the most-targeted sector, while social media threats rose across every monitored platform; observed wire-transfer BEC attacks fell 25%.
Key points
- APWG counted 971,181 phishing attacks in Q1 2026, up from 853,244 in Q4 2025; its figures draw on member and public reports and reported phishing URLs.
- Telecom accounted for 33% of attacks in the sector analysis, up from 5.9% in Q3 2025; SaaS/Webmail was next at 20%.
- Crane Authentication reported a 15% rise in telephone-based fraud, including vishing and smishing, compared with Q4 2025.
- ZeroFox found social media threat volume increased on every platform it monitored. Impersonation and scams made up 43.8% and 27.1% of threats, respectively.
- Fortra reported a 25% quarter-over-quarter decrease in observed wire-transfer BEC attacks and a 15% decrease in the average amount requested, to $42,663.
- Gift cards were the most common reported BEC cash-out method at 48%; 72% of attacks used free webmail domains.
Article Details
- Publisher
- APWG
- Report Period
- January-March 2026; published 2026-05-21
- Scope
- Reported phishing and identity-theft activity, social media threats, and business email compromise, drawing on APWG submissions and member and research-partner data.
- Sample Size
- Fortra examined thousands of BEC attacks; the overall sample size is not disclosed.
- Key Statistics
- Reported phishing attacks increased 13.8%, from 853,244 in Q4 2025 to 971,181 in Q1 2026.
- Telecom accounted for 33% of attacks in Q1 2026, up from 5.9% in Q3 2025, according to Crane Authentication.
- Social media threats in Q1 2026 were 43.8% impersonation and 27.1% scams, according to ZeroFox.
- Fortra reported that 72% of BEC attacks in Q1 2026 used free webmail domains; Gmail was used in 53% of those cases.
- Fortra reported that wire-transfer BEC attacks observed in Q1 2026 decreased 25% from the prior quarter.
MITRE ATT&CK
People
Threat Actors
Vendors
Crane AuthenticationIn the first quarter of 2026, APWG founding member Crane Authentication found that the Telecom category was the most-attacked, rising from 5.9 percent of all attacks in Q3 2025 to 33 percent of all attacks in Q1 2026.FortraAPWG member Fortra tracks the identity theft technique known as “business e-mail compromise” or BEC, which was responsible for $2.8 billion dollars in reported losses in the U.S.ZeroFoxAPWG member ZeroFox detects and remediates targeted phishing attacks, credential compromises, brand hijacking, and other threats.
Products
BlueskyThreats on Tumblr grew 200 percent, Twitch followed at 149 percent, and Bluesky had 94 percent growth.GmailOf the free webmail providers, Google’s Gmail was used most often, in 53 percent of cases.LinkedInTikTok (133 percent growth) and LinkedIn (130 percent) continued their upward trajectories from 2025.RedditAt the other end, Reddit (7 percent) and VK (4 percent) posted the lowest growth rates, though stabilization at any positive number still means the threat volume is growing, just more slowly than before.TikTokname]bank login", or visited from a certain social media site (i.e. a user clicked on a comment in a Tiktok video). Otherwise, the visitors will see innocuous-looking content, or may be redirected to another site.TumblrThreats on Tumblr grew 200 percent, Twitch followed at 149 percent, and Bluesky had 94 percent growth.TwitchThreats on Tumblr grew 200 percent, Twitch followed at 149 percent, and Bluesky had 94 percent growth.VKAt the other end, Reddit (7 percent) and VK (4 percent) posted the lowest growth rates, though stabilization at any positive number still means the threat volume is growing, just more slowly than before.
Industries
Federal governmentFederal Government moved up sharply to 23.6 percent from 15.7 percent.financeFinance remained the top target, suffering 27.9 percent of all attacks, but that is meaningfully down from 35.5 percent last year.HospitalityFederal (24%), Transportation (8%), Retail (6%), Technology (6%), Business Services (5%), Media (4%), Hospitality (4%), Manufacturing (3%), Non-Profit (1%), other (11%).]Non-profitRetail (6%), Technology (6%), Business Services (5%), Media (4%), Hospitality (4%), Manufacturing (3%), Non-Profit (1%), other (11%).]Retaildisplaying Most-Targeted Industry Sectors in Q1 2026: Telecom (33%), SAAS / Webmail (20%), eCommerce / Retail (8%), Social Media (8%), Financial Institution (8%), Payment (8%), Other (7%), Cryptocurrency (5%),SAAS / WebmailState and local governmentThreats against State and Local Government grew 229 percent.Telecommunications- **Phishers targeted the Telecom and SaaS/Webmail sectors** most frequently.