UK phishing links surge as Ireland sees colleague lures

KnowBe4 has published a phishing threat report covering the UK, Ireland and other markets, highlighting different attack patterns in the UK and Ireland.

Malicious links accounted for 74.1% of dangerous emails in the UK, compared with 66.2% globally, making the UK the second-highest market for that tactic. Company impersonation in the UK also rose from 10.0% to 17.3% over six months.

In Ireland, the pattern was different. Colleague impersonation made up 12.7% of dangerous emails, more than three times the global average of 3.6%, while spear phishing reached 8.0%, against a global rate of 4.9%.

Across all markets covered, phishing volumes increased by 29.8% year on year. Attackers are shifting away from broad, low-effort campaigns towards more targeted approaches, with spear phishing rising by 41.1% and pre-attack scouting increasing by 34%.

The findings were based on data from KnowBe4's inbound email security product, which processes 1.15 billion event signals each day. Organisations received an average of one dangerous email for every 733 emails, according to the report.

Shift in tactics

The report pointed to a decline in several forms of mass phishing. Mobile-focused scams fell by 47%, 419 fraud by 31%, and missed-message lures by 11%.

At the same time, attackers increasingly used legitimate infrastructure to make fraudulent messages appear more credible. In the third quarter of the year, an attack was twice as likely to originate from legitimate infrastructure as in the previous quarter, the findings showed.

AI platforms have also become a newer route for this activity. Threat actors were hosting fake developer consoles, sign-in prompts and download hubs directly on native AI platform domains, the report said.

Attackers were also responding more quickly to breaking news. Using generative AI and agent-based tools, they were five times faster at turning headlines into phishing lures than in 2022.

Toolkits and targets

Commercial phishing toolkits are also playing a larger role. Toolkit-driven phishing grew by 54% and accounted for 29% of all inbound malicious mail, with three main toolkits responsible for 90% of all kit-driven phishing in the dataset.

The report said attackers were increasingly trying to bypass passwords through authentication phishing, device-code logins on platforms such as Microsoft Teams, and OAuth consent abuse aimed at taking over sessions and permissions.

Business email compromise accounted for 51% of phishing types identified in the report. HR, Finance and Executive Leadership were listed as the most targeted departments.

Attacks were also concentrated around the working week. The findings showed that 90% of phishing emails arrived between Monday and Friday, with Monday alone accounting for 21% as inbox volumes were highest.

The report also examined patterns in Germany, Spain and France, alongside the UK and Ireland, as part of a wider review of European phishing activity.

Jack Chapman, Senior Vice President of Threat Intelligence at KnowBe4, said attackers' methods had evolved beyond traditional warning signs. "For years, security advice has focused on a predictable checklist: check the sender address, hover over the link and look for the padlock," Chapman said. "While still foundational, that guidance is becoming less useful by the day. Modern phishing has no need to fool security filters with lookalike domains if attackers can sit directly on trusted ones. Attackers can now borrow legitimate infrastructure, harvest permissions instead of passwords, and react to news headlines at machine speed. Trust signals alone are no longer proof of safety, and organisations must rethink where trust belongs as they protect their workforce."