KnowBe4‘s new Phishing Threat Trends Report Vol. 8 finds that Singapore has emerged as a global outlier for old-school fraud, even as attackers worldwide pivot from mass “spray and pray” scams toward hyper-targeted, AI-assisted phishing.
Key Takeaways
- Advance-fee (419) scams make up 24.4% of dangerous email in Singapore, 5.2 times the global average of 4.7% — the highest rate recorded anywhere.
- Colleague impersonation hits 15.9% in Singapore, also the highest of any market globally, even as spear phishing rose 41.1% and pre-attack scouting rose 33.7% worldwide.
- Attackers are now 5.4 times faster at turning breaking news into phishing lures than in 2022, and are increasingly hosting fake sign-in prompts directly on legitimate AI platform domains.
Singapore’s Dual Threat Profile
The report, based on KnowBe4’s Inbound Email Security data drawn from 1.15 billion daily event signals, found overall phishing volume up 29.8% year-over-year, with one dangerous email arriving for every 733 received. Yet the nature of these attacks is shifting: mobile-focused scams fell 47.3%, advance-fee fraud dropped 31.3% globally and missed-message lures fell 11.3%, as attackers redirect investment toward tailored, researched approaches.
Singapore bucks that global decline. Advance-fee scams account for 24.4% of dangerous mail locally — 5.2 times the global average — while colleague impersonation reaches 15.9%, the highest rate recorded in any market KnowBe4 tracks.
“For years, security advice has focused on a predictable checklist: check the sender address, hover over the link and look for the padlock. While still foundational, that guidance is becoming less useful by the day. Modern phishing has no need to fool security filters with lookalike domains if attackers can sit directly on trusted ones,” said Jack Chapman, SVP of Threat Intelligence at KnowBe4.
AI Platforms Become the Newest Trusted Infrastructure
In the third quarter of 2026, an attack was twice as likely to originate from legitimate infrastructure compared to the prior quarter, with AI platforms identified as the newest frontier — threat actors are increasingly hosting fake developer consoles, sign-in prompts and download hubs directly on native AI platform domains. Toolkit-driven phishing grew 54% to account for 29.2% of all inbound malicious mail, with just three toolkits responsible for 90.2% of that volume, while attackers increasingly bypass passwords entirely through device-code logins and OAuth consent abuse.
Business email compromise now accounts for 51.2% of phishing types, with HR, Finance and Executive Leadership the most targeted departments — and 90.4% of attacks still arrive on working days, peaking on Mondays when inboxes are busiest.
