The Most Common Email-Based Cyberattacks in 2026

The most common email-based cyberattacks in 2026 are credential phishing, business email compromise (BEC), attacks sent from hijacked accounts, device code and QR code phishing, calendar invite phishing, and malware or ransomware delivered by email. Phishing is still the most reported cybercrime in the United States, and BEC is still the one that costs businesses the most money. What changed this year is where the attacks come from: AegisAI's Q3 2026 data, drawn from more than 100 million emails across over 1 million protected mailboxes, shows phishing up 49% relative to overall email volume, with more of it sent from real, compromised accounts that pass every sender check (AegisAI Q3 2026 State of the AI Attack Report).

This guide ranks the six email-based cyberattacks that matter most this year, explains how each one gets into the inbox, and gives the one check that catches it. Every number below links to the report it came from, with the date of that report.

The most common email-based cyberattacks in 2026, at a glance

Six attack types account for most of the damage. The table shows how each one gets in, what it is after, and the number that best shows its scale.

For a wider set of figures in one place, see our page of email threat statistics for 2026.

1. Credential phishing is the most reported email-based cyberattack

Credential phishing is the most common email-based cyberattack by volume. The email links to a page that copies a real sign-in screen, and the person who types their password into it hands over their account.

The FBI's Internet Crime Complaint Center (IC3) received 1,008,597 complaints in 2025, and phishing and spoofing was the single largest category, with 191,561 complaints, about 19% of the total (2025 IC3 Annual Report, published April 2026). Reported losses from phishing and spoofing reached $215,843,126 in 2025, roughly three times the $70,013,036 reported in 2024 (same report).

Breach data shows the same pattern from the other side. In Verizon's 2026 Data Breach Investigations Report, phishing remained the initial access vector in 16% of breaches, the same share as the previous year (2026 DBIR Executive Summary).

The check that catches it: look at where the link actually goes, not what the email says it is. A sign-in page for your company hosted on a domain that is days old, or a document share that asks for a password before it shows anything, is credential phishing. Our guide on how to detect QR code phishing in email covers the version of this attack that hides the link inside an image.

2. Business email compromise is the costliest email-based cyberattack

Business email compromise is the email-based cyberattack that costs organizations the most. It usually carries no link and no attachment. It is a short, believable request from someone who appears to be an executive, a colleague or a supplier, asking for a payment or a change of bank details.

The IC3 recorded 24,768 BEC complaints with $3,046,598,558 in reported losses in 2025, the second highest loss of any crime type after investment fraud (2025 IC3 Annual Report, April 2026). That works out to about $123,000 per complaint. The same report says chat generators can quickly write official sounding emails that mimic a company's CEO, and that businesses reported losses of more than $30 million to BEC scams involving AI in 2025.

Verizon's 2026 DBIR tracks the human side of this attack as pretexting: a trusted relationship built through an invented scenario. Pretexting reached 6% of all breaches and has become a more common way into ransomware and extortion attacks (2026 DBIR Executive Summary).

Illustrative example (fictional): a finance manager gets an email from the CFO's name on a personal address. It asks her to update the bank details for a regular freight supplier before today's payment run, and not to copy accounts payable. There is nothing to scan. The only signals are the sender, the request and the fact that the CFO has never asked for this by email before.

The check that catches it: any request to change where money goes is confirmed by phone, on a number you already have, before anyone acts on it. For the full set of controls, read how to prevent business email compromise.

3. Email-based cyberattacks sent from hijacked accounts

The fastest growing source of email-based cyberattacks in 2026 is the real, compromised account. When an attacker takes over a mailbox at a supplier, a partner or your own company, every message they send comes from a genuine address with a clean history. SPF, DKIM and DMARC all pass, because the mail really is from that domain.

AegisAI's Q3 2026 data shows the shift clearly. AI Dragnet attacks, which push one AI-written template to as many organizations as possible, were sent from hijacked accounts 38 times more often than before, rising from 0.2% to 7.7% (AegisAI Q3 2026 State of the AI Attack Report, data from July 1 to September 2, 2026). Attackers are spending less on throwaway lookalike domains and more on accounts that already have trust.

The IC3 saw the downstream effect. Its 2025 report notes that its Recovery Asset Team, which once started most of its fund freezes on BEC cases, saw a rise in tech support and account takeover cases, and that account takeover incidents can involve 50 or more transactions to different banks at once (2025 IC3 Annual Report, April 2026).

The check that catches it: judge the request, not the sender. A known contact who suddenly shares a document that asks you to sign in, or a vendor in a long thread who now wants payments sent to a new account, needs the same scrutiny as a stranger. Our explainer on how email account takeover works walks through the steps from stolen password to outbound fraud.

4. Device code and QR code phishing

Device code and QR code phishing are the email-based cyberattacks built to get around multi-factor authentication. Instead of a fake login page, the victim is sent to a real one.

On May 21, 2026, the FBI warned about Kali365, a phishing-as-a-service kit first seen in April 2026 (FBI IC3 Public Service Announcement PSA260521). The attacker sends an email that impersonates a trusted document sharing service and includes a device code. The victim opens the genuine Microsoft verification page, pastes in the code, and in doing so authorizes the attacker's device. The attacker captures OAuth access and refresh tokens and can then open Outlook, Teams and OneDrive without a password or another MFA prompt. The FBI notes the kit offers AI-generated phishing lures and automated campaign templates, which lowers the bar for less skilled attackers.

QR code phishing works on the same principle of moving the dangerous part out of view. The link sits inside an image, often inside a PDF, so a filter that only reads text links never sees it, and the victim opens it on a phone.

The check that catches it: the FBI recommends restricting or blocking device code flow with a conditional access policy, with narrow exceptions only for business processes that need it (PSA260521, May 2026). For the full story of one kit, see how a device code phishing kit defeated MFA without breaking it.

5. Calendar invite phishing

Calendar invite phishing is the newest of the common email-based cyberattacks, and the one that lasts longest. An invite can add itself to the calendar when it arrives, so the lure stays in front of the user even after the original email is deleted.

In AegisAI's Q3 2026 data, 73% of tracked organizations were reached by one calendar-invite worm (AegisAI Q3 2026 State of the AI Attack Report). The report describes calendar attacks as phishing that lands with no click and outlives the email that carried it.

The check that catches it: when a malicious invite is found, remove the calendar event as well as the email, from every mailbox it reached. Our write-up of a calendar invite worm that spreads mailbox to mailbox shows how one invite became many.

6. Malware and ransomware delivered by email

Malware delivered by email is the attack that turns one click into an incident. The payload arrives as an attachment, an HTML file that rebuilds itself in the browser, or a link to a download, and it gives the attacker a foothold for data theft, encryption and extortion.

Ransomware was present in 48% of all breaches in Verizon's 2026 dataset, up from 44% the year before, while 69% of ransomware victims did not pay and the median ransom paid fell to $139,875 (2026 DBIR Executive Summary). The same report found that exploitation of vulnerabilities, at 31%, has overtaken credential abuse, now at 13%, as the most common way in. Email still matters here, because phishing and pretexting together remain a large share of the starting points.

The IC3 received 3,611 ransomware complaints and 89,129 extortion complaints in 2025 (2025 IC3 Annual Report, April 2026). Many extortion attempts also arrive by email, with threats designed to push a fast payment.

The check that catches it: open every attachment and follow every link in an isolated environment before the user does, and treat an HTML attachment from outside the company as suspect by default. Email remains a leading route into ransomware, as our piece on email as the top attack vector for ransomware and data breaches explains.

How AI changed email-based cyberattacks in 2026

AI did not invent a new type of email attack in 2026. It made every existing type faster, cleaner and cheaper to run at scale.

• More volume from one template. In AegisAI's Q3 2026 data, the share of confirmed phishing that came from AI Dragnet campaigns grew 11.6 times, from 0.5% to 5.8% (AegisAI Q3 2026 report).
• More AI-linked fraud reported. The IC3 received more than 22,000 complaints with AI-related information in 2025, with adjusted losses above $893 million (2025 IC3 Annual Report, April 2026).
• More AI-driven attacks behind breaches. IBM's Cost of a Data Breach Report 2026 reports a 56% increase in AI-driven attacks, led by AI deepfake impersonations and AI-enabled malware (IBM and Ponemon Institute, 2026).
• Attackers using AI at every stage. Verizon's 2026 DBIR says threat actors increasingly rely on generative AI to choose targets, gain a foothold, research vulnerabilities and build malware (2026 DBIR Executive Summary).

The practical result is that the old tells are gone. Spelling mistakes, odd phrasing and generic greetings were never reliable, and AI-written lures do not have them at all. Detection has to rest on what a message is asking the reader to do, and whether that request fits the relationship. For more on this shift, read how threat actors use generative AI to write phishing emails.

Why email-based cyberattacks get past filters and sender checks

Most email-based cyberattacks in 2026 are built to look clean to the tools that inspect email. Three gaps explain most of the misses.

1. Authentication proves ownership, not intent. CISA recommends setting DMARC to reject so that spoofed mail claiming your exact domain is stopped at the server (CISA Phishing Guidance, March 2025). That is worth doing. But a hijacked account and an attacker-owned lookalike domain both pass DMARC for themselves.
2. Reputation needs history. A fresh template, a new domain or a newly compromised mailbox has no bad record yet, so blocklists and reputation scores have nothing to match.
3. The payload is hidden or missing. BEC has no payload at all. QR codes, device codes and calendar invites move the dangerous step out of the text a filter reads.

AegisAI's own measurement puts a number on the gap: 3 in 10 confirmed phishing emails cleared native Gmail and Microsoft filters in Q3 2026 (AegisAI inbound email security page, citing AegisAI Q3 2026 data). Our piece on zero-day email attacks that evade traditional filters goes deeper on why.

What email-based cyberattacks cost when they turn into breaches

When an email-based cyberattack becomes a breach, the bill is larger than ever. IBM puts the global average cost of a data breach at $4.99 million, a 12% increase over the previous year and a record high, driven by higher detection, escalation and lost business costs (IBM Cost of a Data Breach Report 2026).

People remain the common thread. Verizon found the human element in 62% of breaches, up from 60% the previous year, and social engineering was the third most common breach pattern at 16% (2026 DBIR Executive Summary). Attackers are also moving some of the same tricks to the phone: in phishing simulations, the median click rate for voice and text messaging was 40% higher than for email (same report). Email is often where those campaigns begin, with a message that sets up the call.

How to defend against email-based cyberattacks in 2026

The defenses that work in 2026 match the way the attacks work: they check intent, not just identity, and they act after delivery as well as before it.

1. Set DMARC to reject on your own domains. CISA recommends it for sent email and recommends enabling DMARC checks on received email (CISA Phishing Guidance, March 2025). It stops exact spoofing of your name.
2. Move to phishing-resistant MFA, starting with admins. CISA's guidance prioritizes phishing-resistant MFA for administrator and privileged accounts (same guidance). Push notification MFA alone does not stop token theft.
3. Restrict device code flow. Block it with a conditional access policy and allow only the business processes that need it, as the FBI advises (PSA260521, May 2026).
4. Confirm every payment change out of band. No change of bank details or urgent wire goes through on the strength of an email alone, however real the sender looks.
5. Inspect links, files, QR codes and invites before the user does. Follow each link and open each file in isolation, and decode images that contain QR codes.
6. Remove what gets through, everywhere. When one message is found to be malicious, pull it, and any calendar event it created, from every mailbox it reached, including forwards.
7. Train with real examples and make reporting easy. CISA recommends regular training on social engineering and phishing and stresses prompt reporting of suspicious emails (CISA Phishing Guidance, March 2025).

If you are comparing tools to do this, our framework to evaluate email security detection accuracy shows how to measure what each option actually misses.

How AegisAI handles this

AI agents investigate every inbound email for what it is trying to do, and remove the ones that fail from every mailbox they reached. AegisAI reads mail through the Microsoft 365 or Google Workspace API after delivery, with no MX change and no gateway. The median verdict takes 1.9 seconds, and a convicted message is removed from every mailbox it reached within seconds. Every verdict comes with its reason in plain language, so your team can check it and share it.

See how it works on the AegisAI inbound email security page, or book a demo to see these attacks in your own tenant.

Frequently asked questions

What are the most common email-based cyberattacks in 2026?

Credential phishing, business email compromise, attacks sent from hijacked accounts, device code and QR code phishing, calendar invite phishing, and malware or ransomware delivered by email. Phishing and spoofing drew 191,561 complaints to the FBI's IC3 in 2025, the most of any crime type, and BEC caused $3.05 billion in reported losses.

Which email-based cyberattack costs businesses the most?

Business email compromise. The FBI's 2025 IC3 report records $3,046,598,558 in BEC losses from 24,768 complaints, second only to investment fraud across all crime types.

How is business email compromise different from phishing?

Phishing usually tries to steal a password or install malware through a link or file. BEC usually carries no link or file at all. It is a direct request, often for a payment or a change of bank details, from someone posing as an executive, colleague or vendor, or from their real hijacked account.

Does DMARC stop email-based cyberattacks?

Only one kind. A DMARC reject policy stops mail that falsely claims to come from your exact domain. It does not stop lookalike domains, which the attacker owns and authenticates, or hijacked accounts, which send genuine mail.

How has AI changed phishing emails?

AI removes the spelling and tone mistakes people were trained to spot, and it lets one attacker send a polished template to thousands of organizations quickly. AegisAI's Q3 2026 data shows the share of phishing from these AI Dragnet campaigns grew from 0.5% to 5.8% in one quarter.

What is device code phishing?

An attack that tricks a user into entering a code on a real Microsoft sign-in page, which authorizes the attacker's device and hands over tokens that skip MFA. The FBI warned about one such kit, Kali365, in May 2026 and recommends restricting device code flow.

How can organizations defend against the most common email-based cyberattacks?

Set DMARC to reject, use phishing-resistant MFA for privileged accounts, restrict device code flow, confirm payment changes by phone, inspect links, files, QR codes and invites before users do, and remove malicious messages from every mailbox they reached.

Sources

• FBI Internet Crime Complaint Center, 2025 IC3 Annual Report, published April 2026.
• FBI Internet Crime Complaint Center, Public Service Announcement PSA260521 on the Kali365 kit, May 21, 2026.
• Verizon, 2026 Data Breach Investigations Report, Executive Summary, 2026.
• IBM and Ponemon Institute, Cost of a Data Breach Report 2026, 2026.
• CISA, Phishing Guidance: Stopping the Attack Cycle at Phase One, March 2025.
• AegisAI, Q3 2026 State of the AI Attack Report, data from July 1 to September 2, 2026.