The Phishing Email That Works in 2026 (And Why Your Filters Won’t Save You)

The phishing email that worked against your accountant last Tuesday was not badly written. It was not full of broken English. It did not pretend to be a Nigerian prince. It looked like the HR system your company actually uses, addressed her by name, referenced a benefits change she had been waiting for, and asked her to confirm her password through a single sign on flow that worked. By the time the security team noticed, the attacker had a session token, an inbox, and a payroll export.

This becomes the state of phishing in 2026. Email filters are not failing. The model the filters were built for is failing. Most organizations still treat phishing as a content problem, when it has become a session problem, an identity problem, and increasingly a workflow problem. Until that mental model updates, the click rate is going to keep doing what it has been doing.

What a convincing phishing email looks like now

Three patterns account for the majority of successful intrusions that begin with email. None of them rely on the victim being careless.

1. Brand Accurate, context aware messages. The phishing kit scrapes your public website, your LinkedIn, your recent press releases, your support docs, and your job postings. The email it produces uses the same product names, the same screenshots, the same UI terminology that your own support team uses. The grammar is clean because it was written by a model that was trained on your actual customer emails. The signature block matches a real employee the attacker can find on the team page.

2. Compromised legitimate accounts and conversation hijacking. The attacker does not send from a spoofed address. They send from inside your tenant, using a real mailbox they reached through an earlier intrusion, a leaked OAuth token, or a successful credential reset. The email continues an existing thread. It refers to a meeting the recipient actually has on the calendar. It is, in every measurable sense, an internal message. The mail filter cannot quarantine it because the sending reputation, the header chain, and the authentication all check out. Microsoft has documented how this pattern now drives a large share of business email compromise.

3. Adversary-in-the-middle phishing proxies. The link in the email does not point to a fake login page. It points to a reverse proxy operated by the attacker, which sits transparently between the user and the real login portal. The user enters their real password and their real one time code on what looks like the real Microsoft or Google or Okta page. The proxy forwards both to the legitimate service, harvests the resulting session cookie, and passes the session back to the user. The login actually works. The account is now also accessible to the attacker. Toolkits like EvilProxy and others have industrialized this approach, and the FBI’s Internet Crime Complaint Center reports that session hijacking cases now outpace legacy credential theft.

Add to that QR code phishing (the email asks you to scan a code with your phone, where the corporate controls are weaker), MFA fatigue attacks (the attacker triggers dozens of push prompts until the user approves one out of exhaustion), and helpdesk social engineering (the attacker calls the IT service desk pretending to be the user, knowing the helpdesk often resets credentials on the basis of a confident voice), and the model most organizations still have in their heads is several threat generations behind.

Why email filters cannot fix this alone

Secure email gateways catch a lot of attacks. They are not the problem. They are also not the answer, because the attacks that are succeeding in 2026 are not the ones the gateways are designed to catch.

A gateway sees headers, reputation, attachments, URL lists, and content patterns. It does not see whether the message is a reasonable thing for your CFO to be emailing your accounts payable team about. It does not know that the legal department does not normally ask finance to wire funds to a new account on a Friday afternoon. It does not know that the IT helpdesk never asks for a one time code by phone. These are organizational facts. They are invisible to the gateway. The decisions have to happen somewhere else.

The standard claim that “people are the weakest link” is also worth retiring. People are not the weak layer. People are the only layer that can apply business context to an inbound message. The system is failing when the design makes them the only one.

The email filter is not your incident response plan

When a phishing email gets through, the question is not why did the filter miss it. The question is what happened in the seven minutes after the user reported it. If the answer is “the SOC put a ticket in the queue”, you have a problem that no gateway can fix.

Effective response looks like this. The user reports the message through a one click button or a monitored mailbox. Within minutes, security searches the entire tenant for the same sender, the same subject, the same URL, and the same attachment. Any matching messages are pulled from every inbox in the organization, not just the one that reported. Any sessions opened from the affected account in the last 24 hours are force revoked. Any OAuth grants made by that account are reviewed and revoked where suspicious. If credentials were entered, the password is rotated, all sessions killed, and the user is forced through phishing resistant re authentication.

This is not exotic. It is what mature organizations do every day. The reason it is not more common is that the tooling for it is fragmented, the runbooks are not written, and the on call rotation is not staffed. Those are not technical problems.

What an organization level phishing program looks like

The controls below are not new. They are the ones that actually move outcomes in 2026. The order matters: start with the foundations, then layer on the rest.

1. Authenticate your own email. Publish and align SPF, DKIM, and DMARC. Move from p=none to p=quarantine to p=reject over a planned window, using the reporting data to find legitimate senders that need to be fixed before you tighten enforcement. CISA’s Binding Operational Directive 20-01 lays out the federal expectation. Anything that fails DMARC alignment after the window should be blocked, full stop.
2. Move to phishing resistant MFA. push based MFA, SMS codes, and one time links in an app can all be bypassed by an adversary-in-the-middle proxy, an SS7 redirect, or a fatigued user. FIDO2 security keys and passkeys bind the authentication to the origin it is meant for, so the proxy attack no longer works. The UK National Cyber Security Centre and the US Office of Management and Budget both now require phishing resistant MFA on privileged accounts.
3. Treat out of band verification as a business process, not a security control. A request to change a bank account, a payment instruction, a payroll update, or a vendor master record should require a callback to a known number (not the one in the message) or a face-to-face confirmation. The cost is a five minute delay. The benefit is that the most expensive class of business email compromise never closes.
4. Give people a one click way to report. Every mail client, every browser, every mobile app should have a visible “Report phishing” action. Reports go to a mailbox the SOC watches, not a shared inbox nobody owns. Treat reports as a leading indicator. If reporting volume drops, the controls are failing silently.
5. Reward reporting. Stop punishing the click. A culture that humiliates people for clicking a phish produces two outcomes: people stop reporting, and people stop being honest about the near misses. The metric that matters is time to report, not click rate. A click followed by a report in under a minute is a successful control. A click that nobody hears about stands as the real failure.
6. Run short, realistic simulations. The simulation should look like the attacks you are actually seeing, not the cartoon phish of 2018. Use a reputable platform that tracks reporting, not just clicking. Use the data to identify which teams need help, not to name and shame individuals.
7. Protect the people attackers target first. Executives, finance, payroll, HR, IT, and anyone with delegated access are the high value identities. They need stricter baseline controls, more aggressive session policies, and a direct line to the security team that does not require a ticket.

Where the industry still gets it wrong

Two patterns are still common enough to be worth calling out.

The first is treating user education as a substitute for engineering. Training has a real, measurable effect on click rate and reporting rate, but it is not a replacement for aligned DMARC, phishing resistant MFA, and an incident response process that can move in minutes. Organizations that invest only in training are still one proxy session away from a breach.

The second is treating AI assisted phishing as a magic trick. The defenders who talk about it that way lose. The honest framing is that AI has reduced the marginal cost of producing a clean, personalized, convincing message by roughly the same factor it has reduced the cost of producing any other kind of text. That is a meaningful change. It is not a different category of attack. The controls that work against a careful, human written phish also work against a careful, machine written one. The controls that fail against either are the ones that were always going to fail.

The phishing checklist

Use this against your own organization. If you cannot answer yes to most of these, the gap is more important than the next product you are considering.

• SPF, DKIM, and DMARC are published. DMARC is at p=quarantine or stricter on all production domains.
• phishing resistant MFA (FIDO2 keys or passkeys) is required for all privileged accounts and stands as the default for new employees.
• push based MFA and SMS MFA are being phased out, not added to.
• out of band verification is a written procedure for any change to payment details, payroll, or vendor master records.
• Every mail client and browser has a one click “Report phishing” action wired to a monitored mailbox.
• Reported messages trigger a tenant wide search and pull within minutes, not hours.
• Sessions for any account that entered credentials on a known phishing page are force revoked within the hour.
• Simulations are short, realistic, and focused on reporting rather than shaming.
• Executive, finance, payroll, HR, and IT identities have elevated baseline controls and a direct line to the SOC.
• The on call rotation is staffed. Runbooks exist. Tabletop exercises happen at least twice a year.

Phishing is not solved. It is not going to be solved. The realistic goal is to be the kind of organization where a single click does not become a wire transfer, an inbox compromise, or a week of incident response. The controls above are how you get there. They are unglamorous. They work.

Archive note: This article was added retrospectively to the Human Required 2026 archive. Its research and links were reviewed when it was added.

The bottom line

The patterns the post covers have been showing up in production for long enough that the patterns have names, the failures, the mitigations, the gaps. The work the security team and the engineering team and the operations team are quietly doing today sits as the work that decides whether the practice the post names sits as a tool the team uses or a liability the team is paying for.