Based on findings from the Bolster AI 2026 Fraud Trends & Predictions Report
Not long ago, spotting a phishing email was relatively straightforward. Bad grammar, suspicious sender addresses, and obvious fake branding were reliable warning signs. Users learned to look for them and security teams built filters around them.
That playbook is now obsolete.
In 2025, phishing evolved from clumsy impersonation into something far more difficult to detect, and something far more dangerous.
The numbers reflect just how far this has gone.
According to research conducted by the Bolster AI Research Team:
- Nearly 12 million malicious domains were tracked in a single year
- Brands received 30,000+ customer confusion reports per month
- Government impersonation networks published nearly 40,000 pages of realistic content designed to outrank official sources.
This post breaks down the most important phishing statistics and trends from 2025, and what they mean for anyone trying to stay ahead of what comes next in 2026.
Q: Just how big is the phishing problem right now in 2026?
In 2025 alone, researchers tracked approximately *11.9 million malicious domains, with a peak daily average of 378,411 malicious domains active at any given time. This is not a fringe problem. It is a persistent, industrial-scale operation running every single day.
*~11.9 million domain figure reflects domains tracked by Bolster’s platform throughout 2025
Q: Which industries are targeted most by phishing?
Attackers go where trust already exists at scale. The top targeted sectors in 2025 were:
- Technology — 36.13%
- Government + Finance — 26.84%
- E-commerce — 14.72%
- Travel — 13.52%
- Social Media — 8.79%
Technology, government, and finance alone accounted for nearly 63% of all phishing activity. These sectors offer high leverage in the form of a single compromised identity that can unlock accounts, funds, and downstream access across multiple systems.
Q: When do phishing attacks happen the most?
Phishing attacks are far from random. Attackers plan campaigns around predictable moments when users are most likely to act quickly without thinking. These moments include:
- Q1 and Q4: technology access provisioning and renewals
- June: vacation and travel planning
- September and November: government enrollment deadlines and benefit periods
This level of timing is not accidental. It reflects infrastructure built weeks or months in advance, designed to activate when users are already expecting to take action.
Q: What does a phishing attack actually look like?
A modern phishing attack looks like your normal workday. One of the fastest-growing attack vectors in 2025 was workflow abuse, where phishing campaigns disguised as routine business activity. Researchers identified 29,183 unique phishing domains using e-signature and document approval-themed lures. The playbook is straightforward:
- Victim receives an urgent email about a document requiring immediate action
- A masked or shortened link redirects through intermediate infrastructure
- Victim lands on a convincing enterprise login page
- Credentials are captured
No suspicious branding. No obvious red flags. Just a message that looks like every other approval request in your inbox.
Learn more about how to safely open a suspicious link
Q: Is SEO phishing really being weaponized?
In 2025, researchers uncovered 7,168 government-themed malicious domains publishing 39,467 pages of realistic-looking content about benefits, relief programs, and enrollment. These weren’t spam sites, but SEO-optimized networks built to outrank official government sources in search results.
Victims arrived through completely normal Google searches. By the time any phishing occurred, the content farm had already shaped what the user believed was legitimate.
Q: How do people fall for phishing scams?
Because modern phishing is designed to look completely normal. Scams show up inside the tools, workflows, and channels people already use and trust every day. When something looks routine, people act on it without hesitation.
During testing of an abuse mailbox feature with large consumer brands, some organizations were receiving more than *30,000 customer-submitted “is this real?” reports every single month. Of those reports, approximately 35% were confirmed phishing threats. The rest fell into a gray area where even the recipient couldn’t tell whether the message was legitimate.
That uncertainty is the point. When a scam arrives through a trusted channel and references a familiar workflow, it doesn’t need to be convincing on its own. The environment does that automatically.
*The 30,000+ monthly reports and 35% confirmation rate came from beta testing of Bolster’s abuse mailbox feature with large consumer brands
Q: How do companies detect and respond to phishing?
The volume and variety of modern phishing campaigns make manual triage unsustainable. However, organizations that implemented automated abuse mailbox analysis saw a *50% reduction in manual phishing triage, cutting workload significantly while improving response speed.
The difference between reactive and proactive defense is measurable. Fraudulent websites linked to reported messages can be identified and dealt with in hours rather than days or weeks when the right automated takedown systems are in place.
*The 50% triage reduction came from early results of beta testing Bolster’s abuse mailbox feature with large consumer brands
Q: What are the biggest phishing trends in 2026?
Based on 2025 patterns, here is what organizations should prepare for:
- Trusted placements replacing suspicious links: scams arriving through search, ads, and workflows rather than obvious spoofed emails
- Identity platforms acting as force multipliers: one compromised login unlocking access across multiple systems
- Financial fraud becoming faster and more targeted
- Political events driving high-visibility scam campaigns
- Infrastructure rotation outpacing reactive defense: attackers cycling domains faster than traditional blocking can respond
The Bottom Line
Modern phishing succeeds not because users are careless, but because the environment no longer makes it easy to tell what is real. The stats above reflect a threat that has matured from opportunistic attacks into coordinated, business-like operations running at massive scale.
Defending against it requires understanding how attacks are built and distributed, not just how they look at the moment they land in an inbox.
Learn more about how Bolster AI can protect from this year’s phishing and scam trends. Request a demo today.
