Cybersecurity
Mobile Phishing Persists in UAE as Cybercriminals Shift to AI-Powered Attacks
New KnowBe4 findings reveal a significant gap between UAE and global phishing trends, with businesses in the country continuing to face high levels of malware and mobile-focused lures as attackers adopt more targeted methods.
[For more news, click here]
Phishing attacks are becoming more targeted, with cybercriminals spending more time researching organizations and exploiting the digital services their employees use. However, businesses in the UAE continue to face a higher concentration of traditional phishing methods, particularly mobile-focused lures and file-based malware, according to new findings from KnowBe4.
The company's Phishing Threat Trends Report, Vol. 8 found that malware accounts for 6.7% of dangerous emails targeting UAE organizations, compared with 2.9% globally. Mobile-focused lures represent 10% of dangerous mail in the UAE, against a worldwide average of 2.7%, despite a 47.3% decline in this type of phishing globally. Pre-attack scouting also accounts for a larger share of dangerous emails in the UAE, at 4.6% compared with 2.2% worldwide.
Globally, phishing volume increased by 29.8% year over year, with organizations receiving an average of one dangerous email for every 733 emails. Spear phishing rose by 41.1%, pre-attack scouting increased by 33.7%, and company impersonation grew by 28%. Meanwhile, 419 fraud declined by 31.3%. The report draws on KnowBe4 Defend's inbound email security data, which processes 1.15 billion event signals daily.
Attackers Are Exploiting Platforms Businesses Already Trust
A growing concern is the use of legitimate digital infrastructure to host phishing campaigns. In Q3 2026, attacks were twice as likely to originate from legitimate infrastructure as they were in Q2. AI platforms have become part of this trend, with attackers using them to host fake developer consoles, sign-in prompts, and download pages on genuine platform domains.
KnowBe4 highlights the abuse of Claude Artifacts, a feature that allows users to create and display web content within Anthropic's Claude platform. Threat actors have used it to host fake credential-harvesting pages and download portals. Since these pages appear under a legitimate platform domain, employees may have fewer reasons to question their authenticity, while security teams relying on domain reputation checks may struggle to identify the threat.
Artificial intelligence is also helping attackers turn breaking news into phishing opportunities more quickly. According to the report, threat actors are now 5.4 times faster at converting headlines into active phishing lures than they were in 2022. Commercial phishing toolkits are adding to the scale, with toolkit-driven attacks increasing by 54% to account for 29.2% of inbound malicious mail. Three primary toolkits are responsible for 90.2% of these campaigns.
Account access is another area of concern. Rather than relying exclusively on stolen passwords, attackers are increasingly using device-code logins and malicious OAuth consent requests. Campaigns involving Microsoft's Teams platform can persuade users to authorize a login, while malicious applications may request permission to access emails, files, and other connected services. These techniques also raise concerns for organizations using AI agents with access to internal information and business applications.
“For years, security advice has focused on a predictable checklist; check the sender address, hover over the link and look for the padlock. While still foundational, that guidance is becoming less useful by the day. Modern phishing has no need to fool security filters with lookalike domains if attackers can sit directly on trusted ones. Attackers can now borrow legitimate infrastructure, harvest permissions instead of passwords, and react to news headlines at machine speed. Trust signals alone are no longer proof of safety and organizations must rethink where trust belongs as they protect their workforce.” said Jack Chapman, SVP of Threat Intelligence at KnowBe4
Business Email Remains a Major Target
Business Email Compromise (BEC) accounts for 51.2% of phishing types identified in the report, with HR, Finance, and Executive Leadership among the most targeted departments. The timing is also notable: 90.4% of phishing emails arrive during the working week, with Monday accounting for 20.6%.
The concentration of attacks around business hours and departments handling sensitive information highlights the continued risks associated with everyday workplace communication. A compromised account can expose internal correspondence and provide an opportunity to approach colleagues or business partners using a familiar identity.
For UAE organizations, the findings point to the need to address both the malware and mobile phishing campaigns that remain common in the region and newer attacks targeting digital identities. Employee awareness and email security remain important, but businesses also need to pay attention to authentication requests, application permissions, and the access granted to connected platforms and AI agents.
Related Articles
UAE Blocks 750,000 Cyberattack Attempts, With Energy and Education Among Main Targets
The AI Systems Enterprises Are Deploying Have Become the New Attack Surface
