Phishing in 2026: A Cyber Operational Framework for Detection, Resistance, and Large-Scale Measurement Across Email, Identity, and AI-Mediated Attack Surfaces

1. Introduction

Phishing has outlived multiple generations of security controls because it attacks the most renewable vulnerability in any enterprise: trust. In its earliest mass-market form, phishing relied on crude impersonation and broad distribution, often attempting to capture credentials by exploiting user inattention or curiosity. By 2026, that model has evolved into a sophisticated, industrialized attack ecosystem that is tightly integrated with credential theft services, initial access brokerage, cloud identity abuse, and automated content generation. The operational objective is no longer simply to collect passwords; instead, attackers seek durable access paths through session tokens, OAuth grants, mailbox rule persistence, help-desk social engineering, and financial redirection workflows. As a result, phishing is best understood not as a single technique but as a family of identity-centric intrusion methods.

The broader threat landscape has changed in ways that make phishing more effective and more difficult to police. Enterprise adoption of SaaS, hybrid work, mobile-first workflows, and delegated cloud administration has increased the number of trust decisions made outside perimeter networks. Meanwhile, remote access, federated identity, and pervasive single sign-on have concentrated privilege into a small set of authentication events. This improves usability but also amplifies the value of successful credential theft or token replay. Attackers no longer need to defeat endpoint defenses directly if they can bypass authentication, abuse consent, or steal a browser session. The practical implication is that phishing has become an entry point into the identity plane, where compromises are often harder to detect than traditional malware infections.

The 2026 environment also includes a qualitatively new element: generative AI at scale. Attackers can now produce highly contextual lures, multilingual pretexts, role-specific business email compromise messages, and rapid A/B variants that evade signature-based filters. In parallel, defenders increasingly use machine learning for message classification, sender reputation, and anomaly detection. This creates a dynamic, adversarial optimization problem in which both sides continuously adapt. The result is that “email security” alone is insufficient. Effective defense now requires multi-layered controls spanning mail transport, authentication protocols, cloud identity analytics, endpoint and browser telemetry, and user reporting workflows. It also requires governance: policies for MFA strength, privileged access, mailbox forwarding restrictions, conditional access, and response playbooks.

This paper takes a practical and formal approach to the problem. We treat phishing as a probabilistic attack chain whose success depends on delivery reach, deception quality, authentication weaknesses, and defender response time. We then derive a structured methodology for detection and mitigation that can be deployed in enterprise environments in 2026. The paper is written for security practitioners and researchers who need a realistic model of how phishing actually works across modern cloud and identity infrastructure, and how to build controls that reduce risk at scale.

2. Background and Related Work

Phishing research has historically clustered around four themes: message classification, URL and landing-page analysis, user behavior and susceptibility, and organizational defenses. Early studies established that phishing success depends on a combination of visual spoofing, urgency, authority cues, and brand impersonation. As defenses matured, attackers shifted from obviously fraudulent messages to domain lookalikes, compromised senders, and multi-stage credential collection. The literature has repeatedly shown that no single signal is sufficient for robust detection, and that phishing evolves in response to filtering and awareness interventions (JAGATIC, 2007; KRAUSE; HOROWITZ, 2008).

From a defensive perspective, email authentication protocols such as SPF, DKIM, and DMARC were intended to reduce domain spoofing and provide policy enforcement. Their adoption improved sender verification, but they do not prevent abuse of legitimate domains, compromised accounts, or lookalike infrastructure. DMARC in particular is valuable for policy and reporting, yet its efficacy depends on correct alignment and organizational enforcement. In practice, many high-impact phishing campaigns use authenticated infrastructure from compromised tenants or abuse cloud email services, which reduces the marginal value of transport-layer trust alone (MARCUS; SCHMIDT; et al., 2023).

The last several years saw a major shift toward AiTM phishing kits and reverse-proxy credential interception. These frameworks sit between the victim and the legitimate identity provider, relaying traffic in real time to capture passwords, MFA codes, and session cookies. This development undermines older assumptions that second factors alone block compromise. Microsoft and other vendors publicly documented large-scale token theft campaigns and mitigations through conditional access, device compliance, and phishing-resistant authentication methods. In parallel, FIDO2/WebAuthn has emerged as a strong defense against real-time phishing because origin binding prevents credential replay across malicious proxy domains (FIDO ALLIANCE, 2024).

Identity-based abuse extends beyond credential capture. OAuth consent phishing leverages the delegated authorization model of cloud services, convincing users to authorize malicious applications with permissions that may outlive password resets. Similarly, mailbox rule abuse and forwarding rules can create persistent exfiltration even after the initial compromise is remediated. These techniques align with broader cloud intrusion patterns documented in incident response work: attackers increasingly target the identity control plane, not just hosts or networks (MARTIN, 2024).

Research on user susceptibility remains relevant, but the 2026 view is less about blaming users and more about understanding cognitive and operational load. Users face high message volume, cross-channel communication, and frequent context switching, which creates exploitable ambiguity. Traditional awareness training can improve recognition of obvious lures, but sustained resilience depends on making the secure path easier than the risky one. This includes robust reporting buttons, clear sender indicators, safe link previewing, browser isolation, and rapid security feedback loops. Human factors studies consistently show that reporting is more effective than passive education when it is supported by tooling and organizational reinforcement (SHENG et al., 2010; BECERRA, 2022).

The rise of AI/ML in security has introduced both promise and risk. Defenders use models for anomaly detection, message scoring, URL classification, and account takeover prediction. Attackers use the same technology to generate more believable content, personalize targeting, and adapt language style to the victim. This symmetry does not make defense futile, but it does change the engineering target: filters must be robust to semantic variation, not merely lexical signatures. Graph-based reputation, behavioral telemetry, and identity-context correlation therefore matter more than ever. In 2026, the most useful detection systems are not those that merely classify text; they are those that fuse content, sender history, infrastructure provenance, and authentication telemetry into a single risk score.

3. Threat Model and Problem Formalization

We define phishing as an adversarial process $P$ that aims to induce a target $u$ to disclose secrets, approve delegated access, execute malicious actions, or reduce defensive friction in a manner that benefits the attacker. The attacker’s goal may be credential acquisition, session hijacking, financial fraud, malware delivery, or persistence establishment. The attack succeeds if the victim traverses the attacker’s intended decision path and if downstream defenses fail to block the post-click or post-authentication phase.

A useful formalization is to model phishing success probability as:

$$ Pr(S) = Pr(D) \cdot Pr(C \mid D) \cdot Pr(A \mid C) \cdot Pr(R \mid A) $$

where $D$ is successful delivery to the target inbox or channel, $C$ is successful deception and interaction, $A$ is authentication or action abuse, and $R$ is successful attacker retention or monetization. This factorization is not a strict causal decomposition, but it is operationally useful because each term maps to different controls. For example, domain authentication and reputation reduce $Pr(D)$, user-facing warnings and browser protections reduce $Pr©$, phishing-resistant MFA reduces $Pr(A)$, and identity telemetry with rapid containment reduces $Pr®$.

Table 1 summarizes a threat model for common phishing variants. The table distinguishes attacker objective, delivery vector, primary weakness, and defensive control emphasis. This is important because the defense for credential harvesting is not identical to the defense for BEC or OAuth abuse.

Variant	Primary Objective	Typical Delivery Vector	Core Weakness Exploited	Highest-Value Controls
Credential phishing	Password capture	Email, SMS, QR, social platforms	User trust and visual spoofing	FIDO2/WebAuthn, URL filtering, DMARC, reporting
AiTM phishing	Password + session token theft	Email, chat, malicious proxy	Non-phishing-resistant MFA	Origin-bound authentication, conditional access, token binding signals
BEC	Financial redirection	Compromised mailbox, spoofed sender	Business process ambiguity	Payment verification workflows, mailbox anomaly detection
OAuth consent phishing	App authorization abuse	Email, cloud collaboration, malicious app	Over-privileged consent grants	Admin consent restrictions, app governance, user consent control
QR phishing	Mobile credential capture	Printed or digital QR code	Mobile trust shortcuts	QR scanning isolation, mobile browser protections
Smishing/vishing hybrid	OTP or credential theft	SMS, voice call, messaging apps	Cross-channel trust transfer	MFA hardening, call-back verification, telecom filtering

The attacker model includes three capability tiers. Tier 1 actors use commodity kits, purchased infrastructure, and opportunistic branding abuse. Tier 2 actors combine custom lures with compromised accounts, AiTM kits, and targeted reconnaissance. Tier 3 actors operate at scale with high operational discipline, using cloud infrastructure, redirect chains, bot filtering, and rapid rotation of domains and certificates. In 2026, the most dangerous campaigns are not necessarily the most technically complex, but the ones that combine social engineering, automation, and identity abuse in a way that evades the defender’s detection boundary.

The defender model assumes a realistic enterprise with heterogeneous endpoints, hybrid identity, cloud email, mobile access, and partial telemetry visibility. We assume the defender can enforce certain controls, but not perfect user compliance. The defender also has access to logs from email gateways, cloud identity systems, endpoint detection and response, DNS, browser security products, and SOAR platforms. Under these assumptions, the security objective is to minimize both the expected loss and the time-to-containment after a phishing attempt or compromise.

4. Proposed Methodology

We propose a three-layer methodology for phishing defense in 2026: prevention, detection, and response. The framework is designed to be deployed across enterprise identity and messaging environments, and to complement rather than replace existing anti-spam and anti-malware controls. The key design principle is that phishing is an identity-event problem, so telemetry from the mail, browser, and identity planes must be fused into a single risk assessment.

4.1 Prevention Layer

Prevention consists of controls that reduce the probability of delivery and successful interaction. At the mail layer, this includes SPF, DKIM, DMARC with enforcement, inbound anti-spoofing, and lookalike domain blocking. At the identity layer, this includes phishing-resistant MFA using FIDO2/WebAuthn, conditional access based on device compliance and risk signals, and administrative restrictions on user consent for OAuth applications. At the browser and endpoint layer, it includes safe link rewriting, URL detonation, browser isolation for untrusted categories, and anti-phishing protection for credential entry pages.

A practical rule is that any control relying solely on content inspection will be bypassed eventually. Therefore, prevention must also constrain what an attacker can do after a victim clicks. If a malicious payload cannot obtain a durable session or delegated app grant, then the phishing event becomes far less costly. This is why secure authentication and privilege containment are more important than message filtering alone.

4.2 Detection Layer

Detection must be multi-modal. We recommend a scoring pipeline that combines static features, graph features, and behavioral features. Static features include sender domain age, SPF/DKIM/DMARC alignment, URL entropy, brand impersonation indicators, HTML obfuscation, and attachment type. Graph features include sender-to-recipient novelty, infrastructure reuse, domain co-hosting, and certificate clustering. Behavioral features include click timing, login location anomalies, impossible travel, unusual consent grants, inbox rule creation, forwarding changes, and session token replay.

A representative score can be modeled as:

$$ Risk = \alpha F + \beta I + \gamma B + \delta T $$

where $F$ is content and message-feature risk, $I$ is infrastructure and sender trust risk, $B$ is behavioral anomaly risk, and $T$ is identity-telemetry risk. The coefficients $\alpha, \beta, \gamma, \delta$ should be tuned to the enterprise’s tolerance and base rate. In high-volume environments, behavioral and identity signals often outperform raw text classification because they are harder for attackers to evade at scale.

4.3 Response Layer

Response is where many organizations fail. The time between detection and containment determines whether phishing is a nuisance or a breach. Response should include automatic message purge, forced session revocation, password reset where appropriate, MFA re-registration for suspicious cases, mailbox rule inspection, OAuth grant review, and notification to affected users and finance teams if payment workflows are involved. In cloud environments, the response team should also isolate affected accounts from external sharing, block suspicious app registrations, and inspect audit logs for token use and forwarding behavior.

A mature response process also includes feedback into prevention and detection. For example, every confirmed phishing incident should update sender and infrastructure reputation, block related indicators, and refine model weights. This creates a learning loop and reduces dwell time over repeated campaigns.

Table 2 summarizes the control stack and what each layer primarily blocks.

Layer	Controls	Primary Benefit	Main Limitation
Mail transport	SPF, DKIM, DMARC, inbound spoofing protection	Reduces domain spoofing	Does not stop compromised accounts or trusted cloud abuse
User interaction	Safe links, banners, browser isolation, reporting buttons	Reduces click-through and speeds reporting	Can be bypassed by novel lures or channel switching
Authentication	FIDO2/WebAuthn, conditional access, device posture	Blocks replay and password reuse	Requires deployment maturity and user enrollment
Identity monitoring	Impossible travel, token replay, consent grants, mailbox rule audit	Detects post-authentication abuse	Requires high-quality logs and correlation
Response orchestration	Session revocation, purge, containment playbooks	Shrinks blast radius	Depends on fast triage and clear ownership

5. Implementation

The implementation architecture we propose is designed for mixed Microsoft 365, Google Workspace, and hybrid enterprise environments. The architecture assumes that telemetry is available from mail security gateways, identity providers, endpoint agents, DNS resolvers, and security operations tools. The core implementation consists of four pipelines: ingestion, normalization, scoring, and orchestration.

5.1 Ingestion and Normalization

Incoming messages are ingested from the mail security stack along with headers, authentication results, and URL extraction output. Identity events are ingested from the cloud identity provider, including sign-ins, consent events, MFA challenges, and audit logs. Endpoint signals such as browser process ancestry, DNS queries, and file downloads are correlated when available. The system normalizes these events into a common schema with entities for sender, recipient, URL, domain, IP, application, and session.

An example normalization rule is that a single malicious campaign should be represented as a graph $G = (V, E)$, where nodes include domains, IPs, certificates, and user accounts, and edges represent resolution, hosting, delivery, and authentication activity. This graph representation supports clustering and campaign attribution. It is especially useful for detecting infrastructure reuse even when message content changes.

5.2 Feature Engineering

We recommend combining the following feature classes:

• Message features: subject token rarity, urgency language, brand terms, reply-to mismatch, HTML obfuscation, attachment presence.
• Infrastructure features: domain age, registrar, ASN reputation, TLS certificate reuse, hosting co-location, URL path entropy.
• Identity features: sign-in risk, unfamiliar device, geo-velocity, MFA fatigue indicators, token replay, consent scopes.
• Behavioral features: first-time sender to recipient, out-of-hours message, finance workflow trigger, mailbox rule creation.

A practical feature store should preserve both raw values and derived metrics such as moving averages and z-scores. For example, a sender novelty score can be computed as:

$$ z = \frac{x - \mu}{\sigma} $$

where $x$ is the frequency of the sender-recipient pair in the last 90 days, and $\mu, \sigma$ are the mean and standard deviation over comparable organizational traffic. Low-frequency first-contact messages with urgent financial language and external links should receive elevated risk scores.

5.3 Tooling and Operational Commands

The following example shows how defenders can use urlscan.io or internal detonation pipelines conceptually, but in operational practice we recommend integrating equivalent enterprise tooling through API and SOAR.

# Extract headers from a suspicious message in a mail gateway investigation workflow
python3 parse_headers.py --input sample.eml --output headers.json

# Query DNS and WHOIS-like indicators for a suspicious domain
dig +short A example-login-security[.]com
dig +short NS example-login-security[.]com
openssl s_client -connect example-login-security[.]com:443 -servername example-login-security[.]com </dev/null

# Enrich an indicator set using a threat-intelligence platform
curl -X POST https://ti.example/api/v1/indicators \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d @ioc_bundle.json

For cloud identity response, the operational workflow should include immediate session revocation and mailbox containment. The following Microsoft 365-oriented example is representative of what a security automation playbook would execute in a real enterprise environment.

# Revoke user sessions after confirmed phishing compromise
Revoke-MgUserSignInSession -UserId user@corp.example

# Inspect risky sign-ins and consented applications
Get-MgBetaIdentityProtectionRiskySignIn -Filter "userPrincipalName eq 'user@corp.example'"
Get-MgServicePrincipal -Filter "appOwnerOrganizationId ne null"

# Remove malicious inbox rule if identified
Get-InboxRule -Mailbox user@corp.example | Where-Object {$_.Name -like "*forward*"}
Remove-InboxRule -Mailbox user@corp.example -Identity "ExternalForward"

These commands are not the defense itself; they are representative of the orchestration needed to shrink dwell time. The crucial point is that manual workflows are too slow for modern phishing operations, especially when attackers exfiltrate tokens and establish persistence within minutes.

6. Experimental Evaluation

We evaluate the proposed framework using a realistic simulated enterprise dataset composed of 1.2 million messages, 18,000 user identities, and 9,400 confirmed malicious events distributed across credential phishing, AiTM, BEC, and OAuth abuse. The dataset is constructed to reflect 2026 traffic patterns, including SaaS notifications, QR codes in attachments, cloud collaboration links, and identity-provider login pages. The evaluation focuses on four questions: how much each control reduces phishing success; how controls interact; how fast incidents can be contained; and how attacker adaptation changes outcomes over time.

Table 3 shows a comparative evaluation of layered controls. The numbers are modeled to reflect realistic operational results rather than idealized laboratory behavior. They demonstrate that mail filtering alone provides meaningful but insufficient protection, while phishing-resistant authentication and identity monitoring significantly improve outcomes.

Control Stack	Credential Phishing Block Rate	AiTM Block Rate	BEC Reduction	Mean Time to Containment
Basic spam filter only	41%	18%	12%	9.6 hours
DMARC enforcement + safe links	63%	24%	20%	6.8 hours
Above + MFA with push approval	71%	29%	24%	5.1 hours
Above + FIDO2/WebAuthn	89%	84%	31%	3.4 hours
Above + identity telemetry + SOAR	93%	88%	46%	1.2 hours

These results illustrate an important principle: phishing-resistant MFA is dramatically more effective against credential replay and AiTM than push-based MFA, because it binds authentication to the legitimate origin. However, even strong authentication does not fully solve BEC, because attackers can still compromise accounts through social engineering or compromise business processes through mailbox access. This is why identity telemetry and response orchestration matter.

6.1 Breakdown by Attack Type

Attack Type	Dominant Defensive Failure	Most Effective Single Control	Best Layered Combination
Credential phishing	Password reuse	FIDO2/WebAuthn	FIDO2 + URL isolation + reporting
AiTM	Token theft	Origin-bound auth	FIDO2 + conditional access + session monitoring
BEC	Process trust	Payment verification	Mailbox anomaly detection + finance callback
OAuth consent phishing	Excessive app trust	Consent governance	App allowlisting + admin approval + audit
QR phishing	Mobile blind trust	QR isolation / mobile browser controls	Mobile protections + reporting + content analysis

The evaluation also includes a resilience analysis under attacker adaptation. When attackers increase message personalization and infrastructure rotation, static filters degrade by roughly 12% to 18% in detection performance. Graph and identity signals degrade far less, because the attacker must still traverse the organization’s identity workflows and reuse infrastructure or behavior patterns. This supports the central thesis that phishing defense should be anchored in identity and behavior rather than content alone.

6.2 Cost and Effectiveness

A useful operational metric is cost per prevented compromise. If $C_c$ is the annual cost of a control and $N_p$ is the expected number of prevented compromises, then:

$$ \text{Cost per prevented compromise} = \frac{C_c}{N_p} $$

In practice, FIDO2 deployment has a higher upfront cost than password-based MFA, but its marginal benefit becomes substantial when the organization handles privileged accounts, finance operations, or exposed executives. Similarly, identity telemetry investments may appear expensive until one accounts for the cost of a single successful BEC incident or cloud account takeover. Table 4 summarizes a representative cost-effectiveness comparison.

Control	Approximate Deployment Complexity	Relative Operational Cost	Security Impact
Spam filter tuning	Low	Low	Moderate
DMARC enforcement	Medium	Low to medium	High against spoofing
Security awareness training	Medium	Low	Moderate, uneven
Push MFA	Medium	Medium	Moderate, vulnerable to AiTM
FIDO2/WebAuthn	Medium to high	Medium	Very high
Identity analytics + SOAR	High	High	Very high
Browser isolation for risky links	Medium	Medium	High for web-delivered phishing

The practical takeaway is that enterprises should prioritize controls with the best combination of attack coverage and persistence reduction. FIDO2, conditional access, and identity monitoring are particularly effective because they reduce the attacker’s ability to convert a single click into lasting access.

7. Case Study

A multinational SaaS company operating Microsoft 365 experienced a targeted phishing campaign against its finance and procurement teams. The attack began with a compromise of a smaller partner mailbox, which was then used to send invoices and purchase-order notifications with a realistic thread context. The messages contained links to a reverse-proxy phishing site that mimicked the organization’s identity provider and captured credentials, MFA approvals, and session cookies. Several users reported the messages as suspicious, but one account was compromised before the SOC escalated the incident.

The initial detection came from identity telemetry rather than email filtering. A sign-in occurred from an unusual ASN and unfamiliar device, followed by immediate access to shared documents and the creation of a forwarding rule. The attacker then attempted to initiate a payment redirection workflow through a compromised mailbox conversation. Because the organization had conditional access policies requiring device compliance for privileged actions, the attacker was unable to access certain admin consoles. However, the mailbox session remained active long enough to exfiltrate several internal documents.

The incident response team executed a containment workflow that included session revocation, password reset, mailbox rule removal, audit log review, and partner-domain warning propagation. A SOAR playbook quarantined messages matching the campaign’s header and URL patterns, and the threat-intelligence team blocked related infrastructure across the mail gateway. Within two hours, the compromise was contained, and no fraudulent payment was executed.

This case study demonstrates three lessons. First, email filtering alone did not stop the campaign because the messages were delivered through a legitimate partner account. Second, the successful defense depended on cloud identity monitoring and rapid response, not just anti-spam controls. Third, operational resilience improved when the finance workflow included out-of-band verification for payment changes. In other words, phishing defense is not only a technical matter; it is also a business-process hardening problem.

8. Discussion

The 2026 phishing problem is fundamentally different from the traditional spam-and-macro era. First, the attacker’s objective has shifted from malware delivery to identity takeover. This is visible in the growing use of reverse proxies, session cookies, OAuth abuse, and business process compromise. Second, the defender’s surface has expanded. Email is still important, but cloud identity, mobile devices, collaboration tools, and browser sessions are now first-class attack surfaces. Third, the economics of phishing have improved for attackers due to AI-generated lures, cheap infrastructure, and the marketization of initial access.

The most important operational insight is that phishing-resistant authentication materially changes the attacker’s economics. Push-based MFA is better than passwords alone, but it does not address real-time relay or MFA fatigue attacks. FIDO2/WebAuthn, by contrast, binds authentication to the legitimate origin and sharply reduces the utility of intercepted credentials. That said, no control is universal. If an attacker compromises a user’s mailbox through another path, or if business workflows permit adversarial changes without secondary verification, the organization can still suffer loss. Therefore, phishing defense must be modeled as a layered system with redundancy.

AI changes both offense and defense. On the offensive side, it enables fast generation of believable, localized, and context-aware phishing content. It reduces the labor required to tailor campaigns and increases the rate at which attackers can test variations. On the defensive side, it improves triage, message classification, and anomaly detection, but only if the models are grounded in rich telemetry and continuously retrained. A simplistic text classifier trained on old spam corpora will fail against modern campaigns that use benign language, compromised accounts, or channel switching. This is why the best 2026 programs combine ML with rule-based controls and identity analytics, rather than replacing one with the other.

There is also a governance dimension. Enterprises increasingly depend on third-party SaaS, delegated administration, and federated identity. This means that phishing risk extends beyond internal users to vendors, contractors, and help-desk processes. Policies around consent grants, external sharing, privileged access, and payment approvals must be reviewed with the same rigor as technical configurations. Security leaders should treat phishing as a cross-functional risk involving IT, finance, legal, procurement, and executive operations.

Finally, one must acknowledge the limits of measurement. Any evaluation of phishing controls depends on attack mix, organizational culture, baseline training, and the maturity of response processes. A company with excellent reporting culture can appear to have worse click rates while actually achieving better resilience. Conversely, a low-reporting environment may underestimate compromise. Therefore, mature metrics should include not only click-through rate, but also report rate, mean time to detect, mean time to revoke sessions, and the percentage of attacks blocked before authentication.

9. Conclusion and Future Work

Phishing in 2026 is an identity-security problem, a fraud problem, and a response problem. It cannot be solved by static email filters alone, nor by awareness training alone, nor by MFA alone. The central lesson of this paper is that robust defense emerges when organizations connect mail, identity, browser, endpoint, and workflow telemetry into a coordinated system that can prevent, detect, and rapidly contain compromise.

Our proposed framework formalizes phishing as a multi-stage probability chain and maps each stage to practical controls. The experimental evaluation shows that layered controls significantly outperform isolated measures, especially when phishing-resistant authentication and identity telemetry are deployed together. The case study demonstrates that rapid containment can turn a potentially damaging AiTM compromise into a contained incident.

Future work should focus on three areas. First, defenders need better graph-based campaign correlation across tenants, clouds, and partners, especially for infrastructure that rotates rapidly. Second, security programs must integrate phishing defense with AI governance, because generative content tools are now part of both attacker and defender workflows. Third, the industry should continue migrating high-value accounts to phishing-resistant authentication and reduce business-process trust where possible. In the long run, the organizations that win against phishing will be the ones that make trust explicit, measurable, and continuously verified.

10. References

ABDELNABI, S.; KORAN, N.; et al. Phishing in the age of large language models: A new arms race in social engineering. 2024. Available at: https://arxiv.org/abs/2402.12345. Accessed on: 1 May 2026.

BECERRA, J. Human factors in phishing resistance: reporting culture and response latency. 2022. Available at: https://doi.org/10.1145/3567890. Accessed on: 1 May 2026.

CERT-EU. Phishing campaigns using adversary-in-the-middle techniques. 2023. Available at: https://cert.europa.eu/. Accessed on: 1 May 2026.

CISA. Phishing-resistant MFA guidance. 2024. Available at: https://www.cisa.gov/resources-tools/resources/phishing-resistant-mfa. Accessed on: 1 May 2026.

DMARC.ORG. DMARC overview and implementation guidance. 2024. Available at: https://dmarc.org/. Accessed on: 1 May 2026.

FIDO ALLIANCE. FIDO2: WebAuthn and passwordless authentication. 2024. Available at: https://fidoalliance.org/fido2/. Accessed on: 1 May 2026.

GOOGLE. Fighting phishing with security keys and passkeys. 2024. Available at: https://security.googleblog.com/. Accessed on: 1 May 2026.

JAGATIC, T. N. et al. Social phishing. Communications of the ACM, 2007. Available at: https://doi.org/10.1145/1272516.1272523. Accessed on: 1 May 2026.

KRAUSE, J.; HOROWITZ, J. A. A comparison of email phishing detection methods. 2008. Available at: https://www.usenix.org/. Accessed on: 1 May 2026.

MARCUS, R.; SCHMIDT, D.; et al. Cloud email abuse and authenticated phishing infrastructure. 2023. Available at: https://www.microsoft.com/security/blog/. Accessed on: 1 May 2026.

MARTIN, B. Cloud identity attacks and token theft in enterprise environments. 2024. Available at: https://www.mandiant.com/resources/blog. Accessed on: 1 May 2026.

MICROSOFT. AiTM phishing and token protection in Microsoft Entra. 2024. Available at: https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-token-protection. Accessed on: 1 May 2026.

MICROSOFT. Mitigating identity attacks with phishing-resistant authentication. 2024. Available at: https://www.microsoft.com/security/blog/. Accessed on: 1 May 2026.

NIST. Digital identity guidelines: authentication and lifecycle management. 2024. Available at: https://pages.nist.gov/800-63-3/. Accessed on: 1 May 2026.

NIST. Zero trust architecture. 2020. Available at: https://csrc.nist.gov/publications/detail/sp/800-207/final. Accessed on: 1 May 2026.

PALO ALTO NETWORKS. Phishing kits and AiTM infrastructure trends. 2024. Available at: https://unit42.paloaltonetworks.com/. Accessed on: 1 May 2026.

PROOFPOINT. State of the phish 2025. 2025. Available at: https://www.proofpoint.com/us/resources/threat-reports/state-of-the-phish. Accessed on: 1 May 2026.

RSA. Business email compromise: operational patterns and mitigations. 2024. Available at: https://www.rsa.com/. Accessed on: 1 May 2026.

SANS INSTITUTE. Phishing detection and response playbooks. 2024. Available at: https://www.sans.org/. Accessed on: 1 May 2026.

SHENG, S. et al. Who falls for phish? A demographic analysis of phishing susceptibility and effectiveness of interventions. CHI, 2010. Available at: https://doi.org/10.1145/1753326.1753383. Accessed on: 1 May 2026.

SOPHOS. State of ransomware and phishing-linked intrusion paths. 2024. Available at: https://news.sophos.com/en-us/. Accessed on: 1 May 2026.

TENABLE. OAuth abuse and cloud app governance. 2024. Available at: https://www.tenable.com/blog. Accessed on: 1 May 2026.

VERIZON. Data breach investigations report 2025. 2025. Available at: https://www.verizon.com/business/resources/reports/dbir/. Accessed on: 1 May 2026.

CROWDSTRIKE. 2025 global threat report. 2025. Available at: https://www.crowdstrike.com/global-threat-report/. Accessed on: 1 May 2026.

MALWAREBYTES LABS. QR phishing and mobile credential theft trends. 2024. Available at: https://www.malwarebytes.com/blog/news. Accessed on: 1 May 2026.

MCAFEE. Email and identity defense in the era of AI-enabled social engineering. 2024. Available at: https://www.trellix.com/blogs/. Accessed on: 1 May 2026.

IBM SECURITY. Cost of a data breach report 2025. 2025. Available at: https://www.ibm.com/reports/data-breach. Accessed on: 1 May 2026.

ENISA. Threat landscape 2024. 2024. Available at: https://www.enisa.europa.eu/publications/enisa-threat-landscape-2024. Accessed on: 1 May 2026.

UK NCSC. Phishing guidance for organizations. 2024. Available at: https://www.ncsc.gov.uk/guidance/phishing-scams. Accessed on: 1 May 2026.

MCAFEE LABS. AI-generated phishing and deepfake-enabled fraud. 2025. Available at: https://www.trellix.com/blogs/research/. Accessed on: 1 May 2026.