AegisAI Perspectives · 030
Email is a top route into ransomware and data breaches because anyone can send to anyone, identity is cheap to fake and one approval hands over tokens.
Email stays a leading way in because anyone can send to anyone, identity is cheap to fake and one approval hands over credentials or tokens. AegisAI's Q3 2026 State of the AI Attack report found phishing rose 49%1. AegisAI reads each message for what it asks the recipient to do, so a forged or hijacked sender earns no trust on its own.
Email holds the human step of the attack: phishing was the most common breach or attack type, seen by 85% of UK businesses and 86% of charities that identified one17. The figures themselves are collected in email threat statistics for 2026, with sources.
An email attack is a chain of seven steps, and each step has a control that breaks it.
SMTP delivers mail from any sender to any address, and the From header is text the sender writes. Publish a DMARC record at p=reject so forged mail from your own domain is refused.
A lookalike domain or a hijacked account passes SPF, DKIM and DMARC checks for its own domain. The report counts 38x more AI Dragnet attacks sent from hijacked accounts, from 0.2% to 7.7%2. Read the Authentication-Results header as proof of the sending domain only.
Mail lands in front of someone who can approve a sign-in, open a file or pay an invoice. One calendar-invite worm reached 73% of the organizations the report tracked3. Treat calendar invites from outside senders as mail and inspect them the same way.
The UK NCSC defines phishing as scam emails with links to malicious websites, which may contain malware such as ransomware19. Check every link at the time of the click after all redirects. Open attachments in a sandbox.
In device code phishing, the victim's approval hands the attacker's session access and refresh tokens5. No password changes hands, and any multifactor prompt has already been passed by the victim. Block the OAuth device code flow with a Microsoft Entra Conditional Access policy, or limit it to the accounts that need it.
Tokens open the mailbox, its files and its address book, and the account becomes the sender for the next wave in step 2. The FBI's IC3 recorded 24,768 business email compromise complaints and $3,046,598,558 in losses in 202511. Revoke sessions and refresh tokens when an account is confirmed compromised, then reset the password.
Keep offline backups and test a restore, because encryption is the last step and the hardest to reverse.
The reports agree that phishing is the most common attack people see, and they disagree on which route opens the most breaches. Each one counts something different, so read the second column before quoting the third.
| Report | What it counts | Figure | What it says about email |
|---|---|---|---|
| Q3 2026 State of the AI Attack report | Phishing, change this quarter | up 49% | Volume is rising |
| Q3 2026 State of the AI Attack report | AI Dragnet attacks sent from hijacked accounts | 0.2% to 7.7%, 38x | Real accounts now send the lure |
| Q3 2026 State of the AI Attack report | Tracked organizations reached by one calendar-invite worm | 73% | One lure spreads across organizations |
| FBI IC3 2025 Internet Crime Report | Complaints by crime type | Phishing/Spoofing first, 191,561 complaints10 | Most reported crime type |
| FBI IC3 2025 Internet Crime Report | Ransomware complaints and losses | over 3,600 complaints, over $32 million | Ransomware is reported far less often than phishing |
| UK Cyber Security Breaches Survey 2025 | Businesses with a breach or attack in 12 months | 43% of businesses, 30% of charities16 | Base for the phishing share below |
| UK Cyber Security Breaches Survey 2025 | Type of breach among those that identified one | phishing 85% of businesses, 86% of charities | Phishing is the most common type by far |
AegisAI reads mail through the Microsoft 365 or Google Workspace API after delivery7. The median verdict takes 1.9 seconds. A convicted message is removed from every mailbox it reached within seconds.
The Wazza kit shows step 5 of the chain in a live campaign: one approval on a real sign-in page handed over the account.
Real case, Threat Watch, 15 Oct 2026. Wazza runs every visitor through four checks before it shows an Adobe-themed device code page. A visitor who passes is asked to type a short code on the real Microsoft sign-in page. That approval hands the attacker's session access and refresh tokens. No password changes hands, and any multifactor prompt has already been passed by the victim. Threat Watch reports token theft, not a ransomware outcome.
Two controls from the chain apply here. Link checks in step 4 see a different page from the one the person sees, because the four checks screen scanners out. Step 5 is where the chain breaks: a Conditional Access policy that blocks the device code flow stops the approval from issuing tokens.
Email reaches a person directly, and ransomware needs only one person to run a file or approve a sign-in. A patched perimeter still accepts mail from any sender, so the inbox stays open when other routes close. The NCSC names ransomware as malware a phishing link may lead to.
In the UK survey, the estimated share of businesses hit by ransomware rose from under 0.5% in 2024 to 1% in 2025, about 19,000 businesses18.
Phishing gives attackers two routes to ransomware: a payload route and an identity route. The payload route sends a link or file that leads to malware. The identity route takes credentials or tokens, then uses the account to move further.
The identity route feeds itself. A hijacked account sends the next lure from a real address, and the report counts 38x more AI Dragnet attacks sent that way. A calendar invite spreads the same way between organizations. Each new account widens access until the attacker can reach file stores and encrypt or copy them.
For the attack types inside this route, see how business email compromise and AiTM phishing work in 2026.
AI-augmented phishing removes the signals older filters relied on: unknown senders and lure pages a scanner can see. Hijacked accounts pass sender authentication for their own domain.
Kits also hide the page from scanners. Wazza screens each visitor through four checks before the lure appears, so an automated scan may never see it. Device code phishing then sends the victim to the genuine Microsoft sign-in page, where checking the domain does not help. A defense that scores the sender or the URL alone misses all three. For the share that still lands, see how much AI phishing reaches the inbox.
Three numbers carry most of the argument: phishing volume, the most reported crime type, and how many organizations report a breach at all. Phishing rose 49% in the report's quarter. Phishing/Spoofing was the top IC3 crime type by complaint count in 2025, with 191,561 complaints. In the UK, 43% of businesses and 30% of charities reported a breach or attack in 12 months.
Quote each with its own denominator. The IC3 figure counts complaints filed, the UK figure counts survey respondents, and the report measures the change in phishing over one quarter. The full set, with sources and definitions, is on the email threat statistics 2026 page.
Build controls for each step of the chain, then add the recovery step email cannot fix.
Track these measures over the month, each from a log you already have.
In the UK survey it is: phishing is the most common attack type, at 85% of businesses that identified a breach.
No, not against device code phishing. The victim passes the multifactor prompt on the real sign-in page, and the attacker receives the tokens. Block or limit the device code flow with Conditional Access, and revoke tokens after a compromise.
DMARC stops forged mail from your own domain. It does not stop lookalike domains or hijacked accounts, which pass checks for their own domain. The report counts 38x more AI Dragnet attacks sent from hijacked accounts.
In the UK estimate, yes: businesses hit by ransomware rose from under 0.5% in 2024 to 1% in 2025.
The email asks for one action: a click, a file or a sign-in approval. That action yields malware or account tokens. The attacker then reads mail and files from inside the account and copies or encrypts data.
Device code phishing turns a real sign-in step around. The attacker requests a short code, and the victim types it on the genuine Microsoft sign-in page. The approval hands the attacker session access and refresh tokens.
