StationX’s 2026 Phishing Statistics Highlight AI and Multi-Channel Threats
Report discovered via Awesome Annual Security Reports.
Summary
StationX’s 2026 roundup compiles phishing data from 50+ sources, highlighting AI-generated phishing, rising voice, SMS and QR tactics, BEC losses and rapid click times. It recommends layered defenses including phishing-resistant MFA, training and automated response.
Key points
- The roundup reports 3.4 billion phishing emails sent daily and says 82.6% of detected phishing emails from September 2024 to February 2025 used AI, citing Keepnet/VIPRE.
- Citing Verizon DBIR 2025, it gives a median 21 seconds to click a phishing link and 28 minutes to report a phishing email.
- The FBI IC3 recorded $2.77 billion in BEC losses from 21,442 complaints in 2024; IBM 2025 puts the average BEC attack cost at $4.67 million.
- The report cites a 442% rise in vishing from H1 to H2 2024, 40% year-over-year growth in smishing, and a 400% increase in QR-code phishing from 2023 to 2025.
- It cites KnowBe4 2025 data that comprehensive awareness training can reduce phishing susceptibility from an approximately 33% baseline to under 5%.
- Recommended defenses include phishing-resistant MFA, user training and simulations, email and URL analysis, automated incident response, mobile protections, and out-of-band verification.
- The article aggregates 76 statistics from 50+ sources, covering 2023–2026; it says some derived figures are based on the author’s analysis.
Article Details
- Publisher
- StationX
- Report Period
- 2023-2026; last updated 2026-05
- Scope
- Phishing statistics and defenses, aggregated from 50+ sources; figures cover global phishing activity and related incidents.
- Sample Size
- 76 statistics aggregated from 50+ sources
- Key Statistics
- Approximately 3.4 billion phishing emails are sent daily, according to the report.
- 82.6% of phishing emails detected between September 2024 and February 2025 reportedly used AI.
- APWG tracked 3.8 million phishing attacks in 2025.
- FBI IC3 reported $2.77 billion in BEC losses from 21,442 complaints in 2024.
- The median time to click a phishing link was 21 seconds, while the median time to report a phishing email was 28 minutes (Verizon DBIR 2025).
- Recommendations
- Deploy phishing-resistant MFA, such as FIDO2 or passkeys, for users, prioritizing executives and finance staff.
- Provide security awareness training with regular simulations, including vishing and smishing scenarios.
- Use email security that analyzes sender behavior and content anomalies to detect AI-generated phishing.
- Sandbox suspicious URLs and perform real-time link analysis, including at the time of click.
- Automate incident response to reset compromised credentials, revoke sessions, quarantine campaign emails, and notify affected users; use out-of-band verification for payment changes and sensitive requests.
People
Threat Actors
Countries
NetherlandsThe Netherlands (17.7%), Russia (13.7%), and other countries show distinct targeting patterns based on financial sector presence and digital infrastructure maturity.North Korea- **$1.5B Lazarus Group ByBit Heist (2025)**: North Korea's Lazarus Group executed a $1.5 billion cryptocurrency heist.RussiaThe Netherlands (17.7%), Russia (13.7%), and other countries show distinct targeting patterns based on financial sector presence and digital infrastructure maturity.United StatesThe United States is the primary target for phishing attacks, with the FBI IC3 receiving 193,407 phishing complaints in 2024.