Berlin – November 06, 2026 -- Spear-phishing rose 41% as cybercriminals shifted from mass campaigns to targeted attacks, according to Volume 8 of KnowBe4's Phishing Threat Trends Report.
Business email compromise accounts for 79% of attacks in Germany
Dr. Martin J. Krämer, CISO Advisor DACH at KnowBe4, said business email compromise (BEC) dominates phishing in Germany at 79% of all attacks. That concentration crowds out nearly every other attack vector. Classic brand impersonation has fallen to 6% in Germany.
Mobile-focused scams fall 47% as attackers abandon spray-and-pray tactics
Indiscriminate campaigns declined sharply. Mobile-focused scam attempts dropped 47%, advance-fee fraud fell 31% and missed-message lures decreased 11%.
Pre-attack reconnaissance climbs 34% as attackers tailor their approach
Attackers are investing heavily in research and customized methods before they strike. Pre-attack reconnaissance increased 34%. Posing as another company grew 28%.
Attackers bypass passwords through device codes and OAuth consent abuse
Authentication phishing is increasingly used to get around passwords. Attackers also exploit device-code sign-ins on platforms such as Microsoft Teams. They abuse OAuth consents to hijack sessions and the permissions of AI agents.
Attackers are active on weekdays 90% of the time.