AI-Driven Phishing and Social Engineering Threats Escalate in Europe and Beyond
Phishing remains the dominant initial access vector for cyberattacks across Europe, accounting for 60% of incidents between July 2024 and June 2025, as reported by the European Union Agency for Cybersecurity (ENISA). The proliferation of Phishing-as-a-Service (PhaaS) platforms, such as Whisper 2FA, has enabled attackers to automate and scale their operations, targeting a wide range of brands including Microsoft 365, Adobe, and DocuSign. These kits now incorporate advanced features like AJAX-based real-time credential and multi-factor authentication code capture, dense encoding, anti-debugging, and browser freezing to evade detection and analysis. ENISA highlights that AI tools have fundamentally reshaped the threat landscape, with large language models (LLMs) being leveraged to enhance phishing campaigns and automate social engineering, resulting in AI-supported phishing representing over 80% of observed social engineering activity worldwide by early 2025. The report also notes a significant rise in attacks targeting the AI supply chain, with adversaries corrupting components used in AI development and deployment. The sophistication of phishing attacks is further demonstrated by the integration of AI-generated lures, deepfakes, and synthetic media, which are increasingly used in vishing, impersonation, and fraud schemes. The use of AI has not only increased the volume and success rate of phishing campaigns but has also introduced new risks, as AI systems themselves become targets for exploitation. Supply chain attacks have intensified, with threat actors abusing critical digital dependencies to maximize impact, often by targeting customers of compromised organizations. The evolution of phishing tactics is also evident in the widespread adoption of clickbait scams, which use sensationalized headlines and engaging visuals to lure victims into revealing sensitive information or installing malware. Despite increased awareness and training, organizations continue to struggle with the effectiveness of phishing prevention, as attackers adapt their methods to bypass traditional defenses. The ENISA Threat Landscape 2025 report underscores the urgent need for organizations to update their security frameworks, enhance identity and access management, and adopt advanced detection and response strategies to counter the growing threat posed by AI-driven phishing and social engineering attacks. The convergence of AI, automation, and supply chain vulnerabilities has created a complex and rapidly evolving threat environment that demands continuous vigilance and innovation in cybersecurity practices.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
4 events from the most recent confirmed update back to the earliest known activity.
Industry reporting says phishing remains Europe's top initial access vector
A KnowBe4 blog published in October 2025 stated that phishing remained the leading initial access vector in cyberattacks across Europe. This reflected continued emphasis on phishing as a dominant enterprise security risk.
ENISA 2025 threat landscape highlights AI-driven phishing trends
ENISA's 2025 threat landscape reporting highlighted how AI is reshaping cyberattacks, including phishing and supply chain abuse. The report framed phishing as a major evolving threat in the broader European threat environment.
Researchers report Whisper 2FA attacks escalating
By mid-October 2025, reporting indicated that Whisper 2FA had become the third most prevalent phishing-as-a-service kit after Tycoon and EvilProxy. Recent versions were said to include stronger obfuscation, anti-debugging features, and other analysis-resistant capabilities.
Whisper 2FA phishing kit begins large-scale intrusion activity
The Whisper 2FA phishing-as-a-service kit was reported to have driven nearly one million phishing intrusions starting in July 2025. It targeted users of brands including Microsoft 365, Adobe, and DocuSign by spoofing emails and capturing credentials and MFA codes in real time.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
5 references tracked. Mallory keeps watching after this page renders.
Phishing Remains the Top Initial Access Vector in Cyberattacks Across Europe
blog.knowbe4.com
Open sourceClickbait Scams: The Misleading Method of Phishing
securityboulevard.com
Open sourceENISA’s 2025 Threat Landscape: AI Reshapes Cyber Attacks, from Phishing to Supply Chain Abuse
socket.dev
Open sourcePhishing training needs a new hook — here’s how to rethink your approach
csoonline.com
Open sourceAttacks with Whisper 2FA PhaaS kit escalate, report finds
scworld.com
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AI-Enhanced Phishing Campaigns and Modern Social Engineering Tactics
Cybercriminals are increasingly leveraging artificial intelligence and advanced social engineering techniques to conduct sophisticated phishing campaigns targeting both individuals and organizations. Recent reports highlight a surge in phishing attacks that utilize AI and machine learning to craft highly personalized and convincing lures, making detection more challenging for traditional security tools. Attackers are now able to scrape social media for personal data, generate emails in a target’s native language, and automate the creation of malicious content, all with minimal effort. One notable campaign tracked since February targets social media and marketing professionals by impersonating well-known brands such as Tesla, Red Bull, and Ferrari, enticing victims to upload resumes under the guise of job opportunities. These emails employ subtle psychological tactics, such as reducing urgency to build trust, and use multi-step processes to create an illusion of legitimacy. Another observed campaign used AI to obfuscate malicious payloads within SVG files, making them harder for security filters to detect. In this case, attackers sent phishing emails from compromised small business accounts, posing as file-sharing notifications, and used self-addressed email tactics to bypass basic detection heuristics. If recipients opened the attached file, they were redirected to credential-stealing websites. Microsoft researchers noted that the complexity and structure of the malicious code suggested it was generated by a large language model, rather than written by a human. The adoption of AI by threat actors is part of a broader trend, with both defenders and attackers racing to outpace each other in the use of transformative technologies. Security experts emphasize the importance of a layered defense, recommending strong passwords, multi-factor authentication, regular software updates, and ongoing user training to identify and report suspicious content. The rise of AI-driven phishing has increased the frequency and sophistication of attacks, with some security centers now detecting a malicious email every 42 seconds. Organizations are urged to remain vigilant, as even basic threat actors can now execute complex attacks with the help of AI tools. The evolving threat landscape underscores the need for proactive monitoring, rapid incident response, and continuous education to mitigate the risks posed by these advanced phishing campaigns. As attackers continue to refine their methods, defenders must adapt by leveraging AI for detection and response, and by fostering a security-aware culture among users. The convergence of AI and phishing represents a significant escalation in cyber risk, demanding heightened attention from both technical and non-technical stakeholders.
Mar 21, 2026
AI-Driven Phishing and Social Engineering Threats in 2025-2026
Security researchers and industry experts are warning of a dramatic escalation in phishing and social engineering attacks, driven by the adoption of AI by both attackers and defenders. Reports highlight that threat actors are leveraging AI to craft highly targeted, convincing phishing emails, automate attack campaigns, and reduce the time from initial compromise to full breach to under an hour. Human Resources-themed phishing, especially termination and compensation adjustment lures, have surged in Q3 and Q4, exploiting employee trust and urgency. Security teams are urged to maintain a human-in-the-loop approach, as over-reliance on AI for detection can create blind spots, and context-driven analysis is now essential to counter increasingly sophisticated tactics. Technical research and incident analysis reveal that attackers are using a variety of new techniques, including voicemail lures, open redirects, and legitimate hosting platforms to bypass traditional email security controls. The rise of mobile device attacks, supply chain threats via malicious apps, and the use of AI prompt injection in CI/CD pipelines further expand the attack surface. Experts recommend organizations strengthen mobile security, enrich detection with threat intelligence, and ensure skilled analysts remain involved in incident response to keep pace with the evolving threat landscape.
Mar 21, 2026
AI-Driven Evolution of Phishing and Enterprise Security Challenges
Phishing attacks have become increasingly sophisticated, leveraging artificial intelligence (AI) to create more convincing lures and evade traditional detection methods. Recent threat intelligence reports highlight that attackers are now combining high-volume, automated phishing campaigns with stealthier, targeted intrusions, making it more difficult for security teams to distinguish between legitimate and malicious activity. Generative AI models are being used by threat actors to craft realistic phishing emails and malware, significantly lowering the barrier to entry for less skilled cybercriminals. The proliferation of AI tools within organizations, including unsanctioned 'shadow AI' applications, has expanded the attack surface and introduced new risks related to non-human identities such as service accounts and autonomous agents. Security experts emphasize that while AI can enhance defensive capabilities—such as anomaly detection and automated response—human expertise remains essential for interpreting alerts and guiding strategic action. The persistent threat of phishing is underscored by data showing that a significant majority of breaches involve social engineering, with phishing accounting for a large proportion of these incidents. Attackers employ a variety of techniques, including deception, impersonation, malicious links, and deepfakes, to trick victims into divulging sensitive information or performing actions that compromise organizational security. Despite advances in security technology, end users continue to be a primary entry point for attackers, as a single click on a malicious link can bypass multiple layers of defense. The challenge for defenders is compounded by human fatigue and resource constraints, which can limit the effectiveness of even the most advanced security tools. Experts recommend a multi-layered approach to defense, combining AI-driven automation with robust employee training and awareness programs. The adoption of phishing-resistant multi-factor authentication (MFA), zero-trust architectures, and behavioral monitoring are cited as effective strategies to counter evolving phishing threats. As organizations increasingly rely on SaaS applications and AI agents, identity and access management (IAM) has become the new front line in enterprise security. Open standards and centralized control over AI-driven interactions are critical for managing the explosion of both human and non-human identities. Security leaders are urged to maintain discipline in provisioning, permissions, and network segmentation, as AI can magnify the impact of any oversight. The ongoing evolution of phishing tactics, fueled by AI, demands continuous adaptation and vigilance from both technology and personnel to maintain enterprise resilience.
Mar 21, 2026