9 Spooky Phishing Trends to Know Heading into 2027

It's the week of Halloween, which means a lot of people are about to answer the door to strangers in costumes. That's fine when it's a kid dressed as a llama, but it's less fine when the costume is a fake IT technician on a Teams call.

Unfortunately, that's what phishing looks like now. Old tells like typos, odd formatting, and a prince in need of a wire transfer, are mostly gone. What's left is crafty scams with much better disguises.

Verizon's 2026 Data Breach Investigations Report (DBIR), which analyzed more than 22,000 confirmed breaches, found the human element was involved in 62% of them.

Your people are still the main target, which means people are still the main defense.

Here are the spooky 10 phishing trends to keep on your radar to stay protected.

1. AI Is Writing the Lures

Just like your team is using AI to polish emails and content, AI has made polished phishing cheap to produce. IBM's 2026 Cost of a Data Breach Report found that more than one in four organizations experienced an attack that used AI, a 56% increase over the prior year. Those attacks added an average of $1 million to the cost of a breach. AI-generated phishing made up 19% of those AI-driven attacks.

Verizon saw the same shift from a different angle. The median threat actor in its dataset used AI across 15 documented attack techniques.

What to do: Retire "look for spelling mistakes" as your main phishing tip. Teach employees to judge a message by what it asks them to do, like click, pay, share credentials, or move fast, not by how it's written.

2. Deepfakes Are Joining the Call

The single biggest category of AI attack in IBM's 2026 report wasn't email. Deepfake impersonation made up 45% of AI attacks, more than double the share of AI-generated phishing.

The best-known example is still the case Arup confirmed in 2024. A Hong Kong finance employee joined a video call with what appeared to be the company's CFO and colleagues. All of them were deepfakes, and the employee made 15 transfers totaling about $25.6 million.

What to do: Put a verification step on any request that moves money or changes access, no matter how real the voice or face seems. A call-back to a known number beats a gut check.

3. Phishing Is More Than Just Email

Email is still the biggest channel, but text and voice phishing are growing fast. The Anti-Phishing Working Group (APWG) reported that smishing (SMS phishing) rose 40% and vishing (voice phishing) rose 20% from the first to the second quarter of 2026.

Employees also seem more likely to fall for these. Verizon found that engagement with mobile phishing simulations ran 40% higher than with traditional email simulations.

What to do: Make sure your security awareness training covers texts, phone calls, and messaging apps, not just email. Tell employees how your company will and won't contact them.

4. Fake Help Desk Calls on Teams Is On The Rise

One of the fastest-growing plays starts with a flood of spam. An attacker signs the target up for hundreds of newsletters, then reaches out on Microsoft Teams posing as IT support and offers to fix the problem. The "fix" is getting the employee to launch a remote access tool like Quick Assist.

Security firm Ontinue reported that about 30% of the organizations it monitored saw at least one fake IT support attempt over Teams in the first half of 2026. Successful compromises clustered around the 20-minute mark of the call.

What to do: Tell employees exactly how your real IT team will contact them, and make it normal to hang up and call back through an official channel. Ask IT whether external Teams chats can be limited.

5. Attackers Are Calling Your Help Desk, Too

The trick also works in reverse. Instead of posing as IT, attackers pose as employees and call the help desk to reset a password or enroll a new device.

Verizon's 2026 DBIR showed pretexting, a real-time social engineering conversation, as the initial access vector in 6% of breaches. That was enough for it to get its own line on the report's chart for the first time.

The costs can be huge. Marks & Spencer's chairman told U.K. lawmakers in July 2025 that attackers first got in through "sophisticated impersonation" involving a third party. The company expected the attack to cost about £300 million.

What to do: Give your help desk a firm identity verification process for password resets and MFA changes, and back them up when they follow it, even when the caller sounds like an executive in a hurry.

6. MFA Alone Isn't Enough

Multi-factor authentication (MFA) still matters. But "adversary-in-the-middle" phishing kits are built to get around it. They sit between the user and the real login page, capturing passwords, one-time codes, and session cookies in real time.

In March 2026, Europol, Microsoft, and security partners disrupted Tycoon 2FA, a phishing-as-a-service kit that did exactly this. At the time, it had about 2,000 criminal subscribers and had used more than 24,000 domains. The win didn't last long. Within cbout a week, Tycoon 2FA was back to its pre-disruption activity levels.

What to do: Keep MFA turned on, and talk with IT about phishing-resistant options for high-risk accounts. Remind employees that entering a code on a fake page hands it straight to the attacker.

7. Business Email Compromise Keeps Getting Pricier

Business email compromise (BEC) is when an attacker poses as an executive, vendor, or coworker to redirect a payment. It's one of the most expensive forms of cyber crime. The FBI's 2025 Internet Crime Report recorded more than $3 billion in BEC losses.

The per-attempt asks are climbing too. Wire transfer BEC attacks rose 88% from the first to the second quarter of 2026, and the average requested wire jumped 45% to $61,732. Although one of the most widely known methods, gift cards were still the most common cashout method, at 54%.

For HR, this often looks like a "new" direct deposit form from an employee, or an executive urgently asking for gift cards.

What to do: Require a second, independent confirmation for every payment change and every payroll or banking update. Train finance, payroll, and HR teams on these requests specifically.

8. Your Cloud Login Is the Prize

Many phishing pages now go after one thing: the employee's work login. In the second quarter of 2026, SaaS and webmail services were the most-targeted sector at 29.1% of phishing attacks, up from 20% the quarter before.

The approach is getting more patient. The same report noted more "two-step" phishing, where an attacker first sends a harmless business inquiry and only sends the malicious link after the target replies. Attackers are also changing sender display names and subject lines to slip past filters.

What to do: Teach employees that a reply-chain doesn't equal trust. If a "known" contact suddenly sends a login link or shared file, verify before clicking.

9. Fake Recruiters and Paid Ads On the Rise

Phishing is showing up wherever people already spend time. Threats on Meta Ads grew 571% from the prior quarter and LinkedIn grew 106%. One contributor described attackers "weaponizing paid advertising infrastructure to reach victims at scale." Another reported more job scams impersonating recruiters and their companies.

This one matters for HR in two ways. Your employees can be targeted by fake recruiters, and your own company's name can be used to scam job seekers.

What to do: Publish how your company recruits, including which domains you email from and the fact that you'll never ask candidates for payment. Keep an eye out for fake postings that use your brand.

Get Ready for 2027: Train Your Employees to Avoid Phishing Scams

None of these trends calls for panic. They call for updating what you teach. Most of them rely on the same few moves: creating urgency, impersonating someone trusted, and asking for something unusual. Employees who know those patterns, across email, text, phone, and video, are much harder to fool.

A few places to start:

• Refresh your phishing training so it covers AI-written messages, deepfakes, texts, and calls.
• Set clear verification rules for payments, payroll changes, and help desk requests.
• Run phishing simulations regularly, and coach people in the moment rather than shaming them later.

On that last point, EasyLlama's Phishing Simulator turns phishing threats into real-world practice. Help employees spot suspicious emails before an attacker gets the chance. EasyLlama sends realistic simulated attacks to inboxes year-round, so stronger instincts form long before an actual threat arrives.

With 200+ email templates modeled after tools like Gmail, Outlook, LinkedIn, and Zoom, employees who click get a short coaching lesson right away, and the AI-powered Risk Analysis Report flags repeat clickers, high-risk teams, and top vulnerabilities.

Learn more about our comprehensive Securirty Awareness Training courses.