What our honeypot caught: phishing trends 2025-2026

Phishing changes fast. The brands attackers impersonate, the messages they send and the techniques they use can shift within weeks. One way we keep track is through our Nimblr phishing honeypots: mailboxes that exist only to attract attackers, so everything that arrives unasked is a clean sample of what is being sent right now.

Between March 2025 and September 24, 2026, Nimblr's European honeypot mailboxes received thousands of unsolicited emails, and the volume is climbing fast. September 2026 was the busiest month on record.

What we received gives us a direct view of what attackers are sending: password warnings, shared documents, invoices, payment notifications and messages from compromised company accounts. It also shows how phishing is changing, and what people need to be prepared for.

Key statistics from Nimblr's honeypot data, March 2025 to September 2026

• Credential phishing was the most common type of malicious email, at 26% of all unsolicited email received.
• 76% of unsolicited emails contained a link, while only 2% carried a risky attachment.
• Microsoft was the most impersonated brand, named in about one in eight emails.
• About 7% of all unsolicited email came from real Nordic company accounts that attackers had taken over.
• September 2026 was the busiest month on record, driven by two Microsoft 365 credential phishing campaigns that ran for 13 days.

Phishing statistics 2026: five findings from our honeypots

• Credential phishing dominates. 26% of all emails tried to steal mailbox or account credentials. Two campaigns in September 2026 alone made up more than 10% of everything the honeypots received, in just 13 days.
• Money is the other major target. Bank and card lures made up 16% of the emails, with a sharp spike in June 2026. Invoice, payment and business email compromise (BEC) lures made up another 11%.
• Links do most of the work. 76% of the emails contained at least one link. Only 2% carried a risky attachment.
• Trusted Nordic accounts are being used to attack others. About 7% of all honeypot mail came from real Swedish, Norwegian, Danish and Finnish company domains, sent from accounts attackers had taken over.
• Phishing comes in short waves. The largest campaigns run for a few days, then stop, and each peak is driven by a different theme.

The common thread is simple: much of today's phishing doesn't look extraordinary. It looks like work.

Phishing trends 2026: the wider landscape

The honeypot data sits within a broader rise in phishing. The Anti-Phishing Working Group (APWG) counts unique phishing websites, identified from the phishing emails reported to it. One site can sit behind thousands of different links, so this is a count of attacks rather than emails.

APWG recorded 853,244 unique phishing sites in Q4 2025, 971,181 in Q1 2026 and 1,069,681 in Q2 2026. June 2026 alone saw 425,808, the highest monthly figure since April 2023. That June peak coincided with a large bank and card phishing wave in Nimblr's honeypots.

Two themes run through this research: attackers want identities and credentials, and trusted relationships increasingly help them get them. A supplier, a partner or a colleague's hijacked account opens doors that a stranger cannot.

Nordic phishing: the Nordic and Baltic picture

National authorities across the Nordic and Baltic region see many of the same patterns as our honeypots: Microsoft 365 account takeovers, invoice fraud, social engineering and increasingly convincing local-language phishing. Several now say that basic MFA is no longer enough on its own.

One development matters most for smaller-language markets. Language used to offer some protection against mass phishing, because poor Swedish, Finnish, Norwegian or Estonian made a message look suspicious at once.

AI-assisted translation has improved so significantly that this is no longer a reliable signal. Estonia's RIA described the language barrier as having "collapsed" in 2025. Our honeypots already receive phishing written in Swedish and Norwegian: about 4% of all emails were in Swedish, and we also saw Norwegian lures such as "Brukerstøtte - aktivering av din konto" ("User support - activate your account").

The most common phishing emails in our honeypots

Credential theft and money dominate. The five categories in the table below, all aimed at logins or payments, account for 73% of the unsolicited emails we analyzed. The chart shows each category's share of all honeypot mail.

What stands out isn't sophistication. It's familiarity: an expiring password, a document someone has shared, an overdue invoice, or a payment notification.

These are the small administrative tasks that fill a normal working day. Attackers don't need to create an extraordinary situation if they can insert themselves into an ordinary one.

The smaller categories follow the same pattern of borrowing everyday trust: parcel notices from FedEx, DHL and PostNord asking for an import fee, fake US tax and Social Security statements, Meta and Instagram page warnings, and fake browser updates such as "Say hello to Arc, update required".

Phishing comes in waves

Monthly honeypot volume in June and September 2026 was three to five times the typical level of 2025. The last 90 days brought more than 50% more emails than the 90 days before.

Volume alone doesn't tell the full story, though. Different types of attack drove different peaks:

This matters for defenders because attackers rotate between themes. Training people only on the lure that was common six months ago prepares them for yesterday's attack.

OneDrive phishing: a campaign spotlight

One attack detected through our honeypots shows another important change: the message can come from somewhere legitimate.

Our honeypots exposed an ongoing OneDrive phishing attack sent from a compromised account belonging to the CEO of an organization behind a major Swedish skiing competition. Nimblr notified the organization and kept monitoring the campaign. The attack worked as a cycle:

The largest recent campaigns were short and intense. Most large campaigns in the honeypot run for one to three days from one or a few sender domains, then stop.

Several campaigns inserted the recipient's own email address into the subject line. It's a simple technique, but it makes a mass mailing feel personal.

Not every campaign is a short burst. Some lures kept coming back for months, rotating between sender domains:

The long-running lures are about documents and payments, the themes that fit most naturally into a normal working week.

Credential phishing, MFA bypass and adversary-in-the-middle (AiTM) attacks

Credential phishing was the largest category in our data, at 26% of all honeypot mail. Password expiry and mailbox deactivation warnings were especially common.

Credentials are valuable because one login can open email, files and payment systems. Modern adversary-in-the-middle kits capture the session as well as the password. Microsoft reports that the Tycoon 2FA kit alone accounted for about 62% of the phishing attempts it blocked by mid-2025, and that it could bypass SMS codes, one-time passcodes and push notifications. Microsoft and Europol disrupted it in March 2026, but similar kits remain available.

The practical point: a password plus an SMS code or push notification is not protection against every phishing attack. Phishing-resistant methods such as passkeys and FIDO2 security keys are much stronger.

OneDrive, SharePoint and DocuSign phishing

Document-sharing lures made up 13% of all honeypot mail, along with the OneDrive attack and messages such as the Swedish "X har delat dokument med dig" ("X has shared a document with you") from compromised Nordic company accounts.

This type of phishing exploits something people have been taught to trust: legitimate cloud platforms. Microsoft has described campaigns that share view-only files on SharePoint, OneDrive and Dropbox so that security tools cannot scan the link inside. Finland's NCSC-FI reported the same SharePoint, DocuSign and Dropbox themes in Microsoft 365 account phishing throughout 2025.

A OneDrive, SharePoint, Dropbox or DocuSign link is not suspicious in itself, and that is exactly what makes these attacks work. So the useful question is not only "Is this a legitimate service?" but "Was I expecting this document?"

Business email compromise, invoice fraud and CEO fraud

Invoice, payment and BEC lures made up 11% of all honeypot mail. At the same time, about 7% of the mail came from compromised Nordic company domains. Together, that means an email can come from a supplier's real address and still be fraudulent.

This kind of fraud is costly. BEC cost US victims USD 3.05 billion in 2025, more than 14 times the losses from phishing and spoofing. APWG says the average BEC wire request rose 45% to USD 61,732 in Q2 2026. Finland's NCSC-FI found that stolen Microsoft 365 accounts were used to send new phishing and invoice fraud, and Swedish police include CEO fraud in their 2025 fraud analysis.

This is why processes around payment changes matter as much as spotting the signs of phishing. A request to change bank details should be verified through a second, trusted channel, however convincing the email looks.

Scams: advance-fee, romance and sextortion

Advance-fee fraud made up 7% of honeypot mail, romance lures 2.3% and sextortion 0.6%. These target people rather than systems. The FBI's 2025 figures show USD 929 million lost to romance and confidence fraud, USD 156 million to advance-fee fraud, and over 75,000 sextortion reports. They reach work inboxes too, and people who feel embarrassed are less likely to report them.

Typical lures included "Dear Beloved" and "Project funding" (advance-fee), "I am waiting for your message" (romance) and "Your personal data has leaked due to suspected harmful activities" (sextortion).

Why these emails get through

The sender can be real

About 7% of all honeypot mail came from Swedish, Norwegian, Danish and Finnish company domains that passed SPF or DKIM. These were real companies whose accounts had been taken over. Filters and people both tend to trust a message from a known, authenticated sender, which is exactly why attackers use them. The sender can be real while the message is malicious.

What these hijacked accounts sent mirrors the OneDrive attack. Roughly 37% was credential phishing, 18% document sharing and 11% invoices, including messages such as "Brukerstøtte - aktivering av din konto" (Norwegian for "User support - activate your account").

Links, not attachments

The data also challenges a familiar idea about phishing. 76% of the emails contained at least one link, while only 2% carried a risky attachment type, most often .rar, .html and .zip. We also found:

• About 6% used redirects or link shorteners such as t.co and bit.ly to hide the destination
• About 5% linked to low-cost domains such as .ru, .top, .xyz, .shop, .site and .online
• Around 1% linked to IPFS gateways, which are hard to take down

Some bank and card lures mixed real brand links with a single malicious one, so a quick hover check can mislead.

Cheap domains are a known pattern. Interisle Consulting Group counted a record 1.5 million phishing domains in the year to April 2025, 77% of them registered by the criminals themselves, and the most abused top-level domains have cheap prices in common.

Checking for a suspicious attachment is no longer enough.

The most impersonated brands in phishing

Microsoft was the most impersonated brand in our honeypots, named in about one in eight emails and more than twice as often as any other brand. Attackers imitate the tools people already use every day.

That is an important limitation of honeypot data: it shows what reached these mailboxes, not the exact distribution of phishing across the whole market. It is also what makes the data useful. We see campaigns as they arrive and can follow how they change.

The human factor: what works in security awareness training

Technical controls stop a lot of malicious email. But today's phishing increasingly succeeds by making the requested action feel normal: open the document, update the password, review the invoice, sign in to Microsoft.

That is where security awareness comes in. People can't investigate every message like a security analyst. The goal is to build habits that help them notice when something doesn't fit, pause before a high-risk action and report anything suspicious quickly.

The evidence shows that how people train matters more than whether they train:

• A UC San Diego Health study of 19,500 staff found no significant link between annual awareness training and lower click rates over eight months.
• Latvia's CERT.LV ran its own phishing simulation of 15,436 emails: 32% were opened, and about one in five recipients entered credentials.
• The human element was present in 62% of breaches in Verizon's 2026 analysis.

A yearly course on its own does little. What helps is regular, relevant practice in the behaviors people need when a real message arrives, based on the lures that are actually circulating.

Reporting is a big part of that. Reporting a phishing email can protect the whole organization, and warn a partner whose account has been taken over.

From honeypot to phishing simulation

This is why Nimblr runs phishing honeypots. We don't collect these emails just to count them. We use them to understand what attackers are doing: the language they use, the services they impersonate, the actions they ask people to take and how campaigns change over time.

Those insights inform the phishing simulations and security awareness content we create. If password expiry messages are circulating, if attackers start abusing a particular cloud service, or if compromised Nordic company accounts are sending local-language phishing, that matters for what people practice on.

Security awareness shouldn't stand still while phishing keeps changing. The closer training is to what people actually encounter, the better prepared they are when the real message arrives.

Want to see how it works? Book a demo and we'll show you how our simulations are built from what our honeypots catch.

NIS2 training requirements

For medium and large organizations in the EU, security awareness is now a legal expectation. The NIS2 Directive (EU) 2022/2555 applies to essential and important entities across sectors such as energy, transport, health, digital infrastructure, manufacturing and public administration.

• Article 21(2)(g) lists "basic cyber hygiene practices and cybersecurity training" among the minimum risk-management measures.
• Article 20(2) requires members of management bodies to follow training, and asks Member States to encourage entities to offer similar training to employees on a regular basis.
• Article 20(1) makes management bodies responsible for approving and overseeing these measures.

The honeypot findings show what that training needs to cover in practice: credential theft through trusted-looking notices, file-sharing links, invoice changes from real supplier accounts, and lures written in the local language.

What organizations should do

The data points to three areas that need to work together: technical controls, processes and people. No single layer solves phishing.

Technical controls

1. Move to phishing-resistant MFA. Passkeys, FIDO2 keys and Windows Hello for Business stop kits that bypass SMS codes and push notifications, as Microsoft and CISA recommend.
2. Respond to a compromised account fully. Revoke active sessions, remove inbox rules the attacker created and review MFA changes. A password reset alone is not enough.
3. Enforce DMARC on your own domains. Move from p=none to quarantine or reject, so attackers cannot send as you.
4. Watch for unusual sharing and sign-ins. Alerts on new inbox rules, mass sharing from OneDrive or SharePoint, and sign-ins from new locations catch takeovers early.

Processes

1. Verify payment changes through a second channel. A call to a known number stops most invoice and vendor fraud, even when the email comes from the supplier's real address.
2. Agree how to warn partners. If a supplier's account is sending phishing, a fast, agreed way to tell them limits the damage for everyone.

People

1. Train on the lures that are live now. Password expiry notices, mailbox deactivation warnings, shared documents and overdue invoices are the patterns to practice, in the local language.
2. Run short, frequent phishing simulations. Regular practice builds the habit of pausing before clicking. Annual training on its own shows little effect.
3. Make reporting easy and blame-free. A report button and a quick thank-you encourage people to report, including embarrassing scams such as sextortion.
4. Train management too. NIS2 expects management bodies to follow cybersecurity training and to oversee the organization's measures.

The goal is to make the organization harder to fool, and faster to respond when someone is.

Frequently asked questions

What are the most common phishing emails in 2026?

In Nimblr's honeypot data, the most common phishing emails were credential phishing lures such as "Password is set to expire today" and "Your mailbox will be temporary deactivated", at 26% of all unsolicited email. Next came bank and card lures (16%), document-sharing lures (13%) and invoice or BEC lures (11%). Microsoft was the most impersonated brand.

What is a phishing honeypot?

A phishing honeypot is an email mailbox that exists only to attract attackers. Because no real person uses it, every unsolicited email it receives is a clean sample of what attackers are sending right now. Nimblr uses its honeypot data to keep its phishing simulations and security awareness training close to real attacks.

How can I tell if a OneDrive or DocuSign share is phishing?

Ask yourself whether you were expecting the document, and if not, check with the sender through another channel before opening it. A request to sign in to Microsoft after opening a share is a common sign of OneDrive phishing. A known sender is not proof of safety, because attackers often send these links from real company accounts they have taken over.

Does MFA stop phishing?

Basic MFA helps, but adversary-in-the-middle (AiTM) phishing kits such as Tycoon 2FA can bypass SMS codes, one-time passcodes and push notifications. Microsoft reports that phishing-resistant MFA, such as passkeys and FIDO2 security keys, can block over 99% of identity-based attacks.

What is business email compromise (BEC)?

Business email compromise is fraud where attackers impersonate or take over a trusted business email account, such as a CEO's or a supplier's, to trick someone into paying money or changing bank details. BEC caused USD 3.05 billion in reported losses in the US in 2025, according to the FBI. The best defense is to verify any payment change through a second, trusted channel.

What does NIS2 require for security awareness training?

NIS2 Article 21(2)(g) lists basic cyber hygiene practices and cybersecurity training among the minimum security measures for essential and important entities. Article 20 requires members of management bodies to follow cybersecurity training, and Member States should encourage organizations to offer similar training to employees regularly. Management bodies are also responsible for approving and overseeing these measures.

Methodology and limitations

• Data covers Nimblr's European honeypot mailboxes from March 2025 to 24 September 2026. September 2026 figures cover 1 to 24 September.
• Legitimate replies and system mail were removed before analysis. Shares in this report are of the remaining unsolicited emails.
• Inbound SPF, DKIM and DMARC filtering is deliberately switched off on the honeypots so they capture as many samples as possible. Delivery rates therefore say nothing about how well filters work.
• Categories come from keyword rules on subject, sender and opening text, so category shares are close estimates.
• Brand shares are approximate because one email can mention several brands.
• Link and attachment analysis is based on the email source only. No links were opened and no attachments were run.
• The honeypots receive email only, so they do not reflect phishing by phone, SMS or social media.

About the external figures: industry and government numbers come from different methods, periods and populations, so they show direction rather than directly comparable rates. Growth figures depend on each source's baseline. Where a primary report was gated or unavailable, the figure is cited from named press coverage.

Sources

Nimblr

• Nimblr honeypots reveal an ongoing OneDrive phishing attack

Nordic and Baltic authorities

• Polisen: Brottsvinsterna för bedrägeribrottsligheten 2025
• Traficom NCSC-FI: Kybertilannekuva 2025 and 2025 warnings
• Finanstilsynet: Svindelstatistikk H2 2025
• NSM Risiko 2026
• Finans Danmark: fraud figures 2025
• Cybertruslen mod Danmark 2025
• RIA: Cyber security in Estonia 2026
• CERT.LV 2025 report
• NKSC 2025, reported by jp.lt
• CERT Polska 2025, via NASK

Industry and government reports

• Verizon 2026 Data Breach Investigations Report
• IBM Cost of a Data Breach 2026, press release
• FBI IC3 Internet Crime Report 2025
• Microsoft Digital Defense Report 2025
• Microsoft: Inside Tycoon2FA and Tycoon disruption
• Microsoft: SharePoint AiTM and BEC campaign
• Microsoft file-hosting BEC campaigns, via The Hacker News
• APWG Phishing Activity Trends Q1 2026 and Q2 2026
• ENISA Threat Landscape 2025
• NIS2 Directive (EU) 2022/2555
• CISA: Implementing phishing-resistant MFA
• Interisle Phishing Landscape 2025 and Domain Name Wire coverage
• UC San Diego Health training study