Can a phishing attack use a genuine domain and still deceive the recipient? According to KnowBe4’s eighth Phishing Threat Trends Report, the answer is increasingly yes. Attackers are using trusted cloud services and platform features instead of relying on obvious imitations, creating what the report calls borrowed infrastructure phishing.
That changes the central security question. It is no longer enough to ask whether the sender controls the domain. Defenders and employees must also question the request, the authorization being offered and the context in which it arrives.
At a glance
- KnowBe4 says global phishing volume increased by 29.8% in 2026 compared with 2025.
- The report estimates one dangerous message for every 733 emails received, although the worst month was one in 647.
- Links represented 66.2% of phishing payloads, while attachments made up 19.1%.
- AI-related impersonation campaigns climbed 228% from April through August 2026.
- Secure email gateways failed to detect 41.3% of phishing emails, and 58.1% of those undetected messages still satisfied DMARC.
How trusted infrastructure became part of the attack
Traditional phishing often relies on a mismatch: the message claims to come from a familiar company, but its domain or website is slightly wrong. Borrowed infrastructure phishing removes much of that mismatch. The address may pass authentication, the certificate may be valid and the requested sign-in may occur on a legitimate platform.
KnowBe4 reports that campaigns are being routed through hyperscalers, API keys are being collected from reputable services and refresh tokens are used to seize active sessions. The fraudulent element is often the reason for contact rather than the technical quality of the page hosting it.
Authentication attacks are particularly significant. During Q3 2026, such operations accounted for 2% of toolkit-based phishing involving links. Among link-based attacks generally, 25.6% possessed a method for bypassing multifactor authentication. Device-code logins and OAuth consent can give an attacker a token or permission that remains useful after the victim changes a password.
Attackers are also using the features their targets already trust. For example, fake developer tools, account-entry screens and software download locations have been placed on established AI websites. During Q3, the probability that a campaign began on legitimate infrastructure doubled from the previous quarter.
Why email filters need a different test
The difficulty is that several familiar trust signals answer only narrow questions. A valid certificate confirms that a site controls its encryption. DMARC checks whether a domain authorized the sending system. Neither establishes that a message is legitimate or that a requested authorization is safe.
KnowBe4 found that secure email gateways overlooked 41.3% of phishing emails, with the rate reaching 48.3% in July. More strikingly, 58.1% of the messages that slipped past those gateways also passed DMARC. Authentication is still valuable, but attackers can now place deception inside authenticated delivery systems.
The shift may be favoring targeted campaigns over indiscriminate volume. Mobile-focused attacks declined by 47.3%, while 419 scams dropped by 31.3%. In contrast, spear phishing increased by 41.1%, reconnaissance activity rose by 33.7% and company impersonation advanced by 28%.
This trade-off matters. Fewer noisy messages can mean less obvious pressure to train users carefully. Meanwhile, each targeted lure can combine personal information, a genuine platform and a request for persistent access.
Who should care, and how
The immediate concern extends beyond email users to anyone responsible for cloud accounts, collaboration tools, developer platforms and AI-enabled systems. KnowBe4 says attackers are pursuing credentials, API keys, quota abuse and malware delivered through downloads hosted on trusted platforms. Stolen API keys and OAuth grants may also allow compromised AI agents to misuse data or redirect their actions.
Employees need guidance based on behavior rather than domain inspection alone. A meeting invitation should be verified if it is unexpected, especially when it asks the recipient to enter a code or approve access. An OAuth screen should be examined for the permissions requested rather than accepted simply because the service and branding appear legitimate.
For example, say a colleague sends a Teams message containing a calendar invitation for a contract review. The invitation leads to a genuine Microsoft login page and requests permission through an OAuth workflow. The employee recognizes the colleague but has never seen the meeting. A second-channel confirmation with that colleague, followed by a review of the requested access, could prevent a persistent compromise.
Security teams should similarly monitor refresh tokens, device-code activity and OAuth grants. Blocking a suspicious domain would not address an attacker operating through legitimate infrastructure.
What to watch next
Expect more phishing lures to cross from email into collaboration channels, including fake invitations and voicemail alerts sent through compromised accounts. The growth of AI-brand impersonation also suggests that trusted AI platforms will remain attractive hosts for credential collection, quota fraud and malicious downloads.
The appropriate response is not to abandon email authentication or platform reputation. Those controls remain useful. They should be combined with continuous training, real-time coaching, behavioral analysis and tighter oversight of access grants.
The crucial distinction is simple: technical legitimacy does not equal instructional legitimacy. A real platform can still be the delivery mechanism for a fake request, so users and defenders must examine what the request seeks and whether its context makes sense.
Key takeaways
- Do not treat a genuine domain, valid certificate or passing DMARC check as proof of a safe request.
- Monitor OAuth grants, device-code logins and refresh-token activity in addition to passwords.
- Verify unexpected meeting invitations and access approvals through a separate communication channel.
Frequently asked questions
What is borrowed infrastructure phishing?
It is phishing delivered through legitimate cloud and platform services rather than obvious copies of trusted websites. The deception depends on the request and the permissions it seeks, not on a technically fake domain.
Does passing DMARC mean a message cannot be phishing?
No. KnowBe4 found that 58.1% of phishing emails missed by secure email gateways still passed DMARC. DMARC checks sending authorization, not whether the message or requested action is legitimate.
Why might a password reset fail to stop an attacker?
Device-code logins and OAuth consent can yield tokens or permissions instead of a password. Those access credentials may remain active after the password is changed.
Which phishing payloads were most prevalent?
Links accounted for 66.2% of payloads, including QR codes. Attachments represented 19.1%, and almost one-third of phishing attachments were PDF files.