Phishing Rises Three Times Faster in Europe Than Globally, Proofpoint Finds

* Phishing threats increased 4.5 times across Europe from 2025 to 2026 compared with 1.5 times globally.
* The UK experienced a six-fold jump in phishing over the same reported period.
* Phishing detections were recorded from July 2025 to September 2026.
* European users clicked on 8.3 out of every 100 delivered threat messages, compared with 2.0 globally.
* 64% of European organizations targeted by precision cloud attacks showed evidence of successful compromise.
* Targeted attacks use phishing and session hijacking to gain access to specific users and accounts.
* Malware accounted for 21% of detected threats in the hospitality and leisure sector, nearly twice the global rate.
* Callback phishing increased by 257% year over year in healthcare organizations.
* Malware detections rose by 84% in healthcare organizations.
* More than 188,000 AI-enabled applications are connected through authentication and OAuth frameworks.
* The proportion of European sensors affected by attacks targeting open-source AI technologies increased 4.6 times between consecutive 90-day periods.

The narrative emphasizes a fundamental shift from generalized threat volume to highly targeted, sophisticated exploitation methods facilitated by the convergence of cloud adoption and generative AI. The escalation in phishing activity, particularly its higher rate in Europe relative to the global average, suggests that attackers are optimizing their social engineering based on regional vulnerabilities or perceived organizational targets. This is coupled with success in precision attacks, where specific access points like session hijacking prove more potent than broad-spectrum attacks. The data concerning espionage and sector-specific malware reveals a landscape where state-aligned actors and specialized threat groups leverage domain knowledge to exploit industry-specific weaknesses, moving beyond volume metrics into targeted compromise.
The emergence of AI integration introduces a critical layer: the infrastructure itself is becoming the target. The exponential growth in AI-enabled applications connected via standard authentication protocols suggests that security gaps are not just in endpoint defense but deeply embedded within the identity and access management framework. The increased impact on open-source AI technology sensors implies that the novel capabilities of AI tools themselves are now vectors for attack, rather than just payloads delivered through traditional means. This dynamic forces a re-evaluation of resilience: defending against mass attacks is insufficient; resilience must account for tailored espionage, sector-specific malware, and vulnerabilities introduced by rapidly adopted technologies like AI agents.
What assumptions drive the narrative that focusing on session hijacking and targeted phishing is an indicator of greater attacker effectiveness? What are the secondary consequences of concentrating risk within cloud authentication frameworks? How does the perceived hype around AI development interact with the measured reality of its rapid adoption in the threat landscape?