This list covers the phishing and social engineering trends in the ENISA Threat Landscape 2026, published in September 2026. The report analyses incidents recorded from 1 January to 31 December 2025. The items are selected by topic, not ranked: every passage ENISA devotes to phishing, ClickFix, smishing, phishing kits and impersonation. All figures are ENISA’s.
What does ENISA’s 77.8% phishing figure mean?
ENISA’s overview says that among social engineering techniques, phishing remains a prevalent intrusion vector (77.8%), followed by malicious spam, or malspam, at 13%. The figure sits under social engineering techniques, shown in ENISA’s Figure 1 as techniques leveraged in identified incidents targeting the EU. The executive summary repeats it, calling social engineering a common enabling tactic to abuse trust, particularly through phishing campaigns (77.8%).
For context, ENISA reports DDoS as the primary incident type (51.3%), followed by unauthorized access (39.5%). ENISA words the 77.8% as a share among social engineering techniques.
- 77.8%Phishing, among social engineering techniques, as an intrusion vectorSource: ENISA Threat Landscape 2026
- 13%Malicious spam (malspam), the next technique after phishingSource: ENISA Threat Landscape 2026
- 38%Increase in phishing domains over the past yearSource: ENISA Threat Landscape 2026
What are the main phishing trends in the ENISA Threat Landscape 2026?
ENISA does not rank these. They are grouped by theme from the report’s overview, its fraud and impersonation section and its cybercrime key trends.
ClickFix
ENISA says an increasing use of the ClickFix technique, abusing victims into “fixing” an issue and ultimately leading to the execution of malicious code, was prevalent in 2025. It lists FileFix as a ClickFix variant. It names ClickFix as a primary initial access vector used by the Qilin ransomware group, using fake human verification prompts. It also says infostealers were often delivered through phishing campaigns, ClickFix lures, fake software updates and compromised cloud services.
ENISA’s conclusion is that ClickFix and device-code phishing illustrate a shift toward techniques that capitalize on abusing trust rather than technical weaknesses alone. For the device-code side, see our posts on device code phishing and MFA bypass and phishing-as-a-service and device code abuse.
Smishing and other channels
ENISA ties its fraud and phishing findings to the increased use of ClickFix and SMS phishing (smishing). It also says email-based phishing methods formed the majority of phishing activity in the period. Other publicly reported activity included voice phishing (vishing) and QR code phishing (quishing), along with business email compromise, malvertising and malspam. ENISA adds that the use of SIM boxes to enable fraud further increased, providing hardware for large-scale attacks such as phishing and smishing. It also notes that campaigns increasingly used trusted communication platforms such as Signal or WhatsApp to start personalized contact.
Phishing kits and phishing-as-a-service
ENISA observed the popularisation of phishing kits and Phishing-as-a-Service (PhaaS) platforms to enable financially motivated activity. It says Tycoon 2FA was reportedly the most widely observed phishing kit globally in 2025, and describes it as an Adversary-in-the-Middle (AiTM) kit designed to bypass multi-factor authentication. Activity linked to Salty 2FA declined from October 2025. ENISA also names XinXin Group, developer of the Lucid PhaaS, active since 2023 with an expanded geographical reach, and the Lighthouse framework, linked to the Smishing Triad.
Operators combined PhaaS infrastructure, AiTM frameworks and malware payloads to bypass MFA and distribute infostealers through AI-themed lures, fake support interactions and smishing campaigns. Background reading: our guide to phishing, the glossary entries on phishing-as-a-service and adversary-in-the-middle, and how cybercriminals use phishing kits.
Impersonation of tax and government services
ENISA says phishing campaigns continued being seasonal. The impersonation of tax authorities and government digital services was observed in at least nine EU Member States. Operators impersonated national tax agencies and e-government platforms to distribute phishing emails, SMS messages and fraudulent tax refund notifications. Common lures were tax reimbursement claims, overdue payment notices and requests to update identity or banking information.
Named fraud and impersonation groups
Of the known groups seen conducting fraud and impersonation in the EU (24.4%), ENISA identifies Smishing Triad, mydocs and Hazy Hawk as the most active. Two of them differ as follows.
| ENISA says | Smishing Triad | Hazy Hawk |
|---|---|---|
| Active since | At least 2024 | At least December 2023 |
| Method | Large-scale smishing campaigns using automated infrastructure | Hijacked cloud resources and abandoned subdomains to host malicious URLs |
| Main targets | France, Ireland, Poland, Germany and Lithuania | Italy, France, Czechia and Sweden |
Domain registration as infrastructure
ENISA says domain name registration is the primary infrastructure for modern cybercrime, with 77% of phishing domains reportedly registered specifically to facilitate attacks. Smishing Triad reportedly manages approximately 25 000 active phishing domains in any given eight-day period. Bulk registration services and free dynamic DNS subdomains, which require minimal identity verification, contributed to a 38% increase in phishing domains over the past year. ENISA states that registries and registrars bear a significant responsibility in detecting and mitigating this abuse. For a closer look at how attackers use DNS in their campaigns, see DNS under siege: threat actor driven abuse. For a closer look at how attackers use DNS in their campaigns, see DNS under siege: threat actor driven abuse.
AI and deepfakes in social engineering
ENISA lists the increase of generative AI and deepfake videos to impersonate trusted contacts among the techniques of interest. It also says AI allows better customization of deceitful content and increases the tempo of fraud activity.
Which sectors and countries does ENISA name for fraud and impersonation?
Fraud and impersonation made up 13.3% of financially motivated claims in 2025, after ransomware (47.3%) and data breaches (36%). By sector, ENISA reports digital providers at 16.6%, public administration at 13.4% and finance/banking at 12.5%, followed by civil society (9.4%) and business services (5.9%). By country, activity was particularly identified in Italy (7.5%), Spain (6.3%) and France (4.7%).
What questions do these findings raise for a security team?
These are checks derived from the facts above, not ENISA recommendations.
- ENISA says email formed the majority of phishing activity but SMS, voice and QR code channels were also reported. Do reports from all four channels reach the same team?
- ENISA describes AiTM kits designed to bypass MFA. Which of your sign-in methods would such a kit target?
- ENISA reports tax and government impersonation that follows a seasonal pattern. Is your staff and customer messaging prepared for the same lures?
- ENISA reports that 77% of phishing domains were registered to facilitate attacks. Do you watch for new domains that imitate your brand?
Two linked pieces cover this from other angles: the initial access techniques list and AI cyber threats in 2026.