Zscaler has published its ThreatLabz 2026 Phishing and Initial Access Report, which shows phishing volumes fell while attacks became more targeted and effective.

Phishing activity declined 20% year on year in both 2024 and 2025 as tighter email and identity controls pushed attackers towards more selective campaigns, according to the report. It also found that 95.2% of phishing attempts were delivered through encrypted traffic, while 87% of all blocked malicious activity used encryption.

The shift points to a change in how attackers seek initial access. Rather than relying on broad, high-volume campaigns, the research describes a move towards fewer but more convincing attempts, including AI-generated websites and tools designed to hijack active user sessions.

In the UK, the study ranks the country second behind the US as a location for phishing infrastructure and hosting. It also places the UK fourth among the most targeted countries, behind Germany, India and the US.

AI and phishing

ThreatLabz identified 413,524 AI-generated site instances during the period covered by the research. Of those, 37,447, or 9.06%, were flagged as malicious.

Tools including Manus AI, Blackbox AI and Lovable AI are being used to create phishing pages that resemble legitimate corporate sites and customer workflows, the report says. It adds that these pages can be produced much faster than through manual development, making it easier for attackers to run targeted campaigns at scale.

Brand imitation remained a central tactic. Microsoft and Google were the most copied brands in phishing attacks, reflecting a continued focus on enterprise identity systems and account credentials.

Another finding centres on efforts to bypass multi-factor authentication. The research cites kits such as BlackForce, which it says are being used to take over active sessions in real time after users have logged in.

Sector targets

The services sector saw the sharpest increase in activity among the industries tracked in the report. Attacks against the sector rose 65.5% year on year, increasing from 330.9 million to 547.7 million hits.

Attackers were exploiting routine trust-based exchanges in billing, onboarding, renewals and support, according to Zscaler. Manufacturing and government also remained significant targets for email phishing, with government hits up 50% as attackers sought high-value intelligence.

Geographically, the US remained the leading target for email phishing attacks. Brazil recorded a 2,522% rise in phishing hosting, making it one of the top five global sources identified in the research.

Encrypted traffic

The report places heavy emphasis on encrypted traffic as a concealment method. By routing phishing content and other malicious activity through HTTPS and other encrypted channels, attackers can blend in with routine web traffic and make detection harder for organisations that do not inspect that traffic closely.

The findings suggest this is no longer a niche tactic. According to the study, encryption has become the default route for a large share of malicious activity, not just phishing.

Separate telemetry in the report points to large-scale hostile scanning before compromise. Data collected from decoys recorded 89.9 million hostile interactions from 1.37 million unique attacker IPs over six months.

This activity included attempts to probe collaboration platforms, identity systems and exposed services to identify weak points before an intrusion attempt. The report also says cloud infrastructure has become a main source of reconnaissance, with more than 121,000 distinct AWS-hosted IP addresses logged probing customer environments.

Using public cloud systems for scanning and credential validation can complicate response efforts because the traffic often originates from infrastructure more commonly associated with legitimate business services. That makes attribution and filtering more difficult for defenders.

The methodology states that the research drew on more than 500 trillion daily signals from Zscaler’s cloud platform and data gathered between January and December 2025, with deception telemetry collected between October 2025 and March 2026.

Deepen Desai, Chief Security Officer at Zscaler, said the changes reflected an adjustment in attacker behaviour rather than any retreat. “We are witnessing a strategic recalibration in the way adversaries approach initial access,” said Desai. “The decline in raw phishing volume isn’t a sign of retreat; it’s a sign of evolution. Attackers are trading quantity for quality, using GenAI to eliminate traditional ‘tells’ like poor grammar and generic lures. With 95% of phishing now hiding in encrypted traffic, organizations can no longer afford to leave their TLS traffic uninspected. A Zero Trust architecture is the only way to break the attack chain, from discovery to data exfiltration.”

Haiilo has formed a strategic partnership with Work Networks, a UK consultancy focused on workplace adoption.

Under the agreement, Work Networks will help organisations implement and roll out Haiilo’s employee experience platform. Its work will include support for community-building, leadership engagement and communication strategies designed to make the platform part of employees’ daily routines.

The move comes as many employers continue to invest in workplace technology while facing weak adoption and engagement across their workforces. Staff are often asked to work across fragmented systems, disconnected communication channels and a growing number of digital tools, leaving employees to manage information overload and competing demands on their attention.

The partnership is part of Haiilo’s wider global partner network. The company operates from offices in the US, UK, Germany and Finland.

Adoption focus

For Haiilo, the tie-up adds a consulting partner with expertise in change management and internal communication at a time when software vendors are under pressure to show that workplace platforms are being used after purchase. The platform is designed to bring communication, knowledge and tools into one place for employees, including frontline and distributed teams.

Work Networks will support organisations through implementation and adoption, rather than only at the point of software deployment. This places the emphasis on workplace habits, leadership behaviour and communication planning, which often determine whether internal platforms gain traction with staff.

Andrew Avanessian, Chief Executive Officer, Haiilo, said: “Employees are often left navigating too many tools, too many systems and too much noise. Attention has become one of the most valuable resources inside any organisation, yet too many workplace experiences are designed in ways that constantly fragment it.

“Haiilo helps organisations create a more connected experience where communication, knowledge and tools work together seamlessly. Partners like Work Networks play a critical role in making that vision a reality, ensuring lasting adoption and meaningful change.”

Consulting role

The partnership also reflects demand from employers for more support with digital workplace change programmes. In many organisations, new systems are introduced into already crowded technology environments, making it harder for staff to know where to find information or which tools should take priority.

This challenge is often more pronounced in businesses with frontline workers or dispersed teams, where communication can be inconsistent and access to corporate systems may vary. By combining software with rollout planning and leadership engagement, companies are trying to reduce the risk that new platforms become underused.

Nick Crawford, Chief Executive Officer, Work Networks, said: “Haiilo’s platform gives organisations a powerful foundation, but technology alone often isn’t enough – organisations also need the right strategy, leadership engagement and cultural change to ensure platforms are truly adopted.

“Our partnership combines Haiilo’s platform with a people-first approach to rollout and adoption, helping organisations create digital workplaces where communication flows naturally and employees feel part of a connected community.”

The controversial, ultra-nationalist figure, whose real name is Stephen Yaxley-Lennon, is expected to speak at the Oxford Union debating society in St Michael’s Street today (Wednesday, June 17).

He will debate a motion on whether the West is ‘right to be suspicious of Islam’, with actor Laurence Fox and politician Sir Jacob Rees-Mogg also due to speak

Tommy Robinson, who has multiple convictions for offences including assault, using a fake passport, mortgage fraud and contempt of court, will debate (Image: PA Media)

Fears among local hospitality businesses, including pubs, restaurants, and coffee shops, have risen as a large demonstration has been planned ahead of the speaker’s arrival.

Multiple reports say as many as five roads are set to be closed from 4pm in preparation, including: St Michael’s Street, Cornmarket Street, Queen Street, Market Street, and Ship Street.

Oxfordshire County Council only confirmed St Michael’s Street would be shut due to the event.

But businesses told the Oxford Mail that county council officials had informed them their streets would be impacted. University of Oxford also posted on social media that Thames Valley Police had told them of the five road closures.

Oxford Union in St Michael’s Street (Image: Roger Askew)

Businesses, particularly pubs who will be closing are concerned about staff and public health and safety and a loss of revenue, on what should be the busiest time for them due to the World Cup.

The Jolly Farmers Pub in Paradise Street said: “Businesses are going to suffer. Communities are going to suffer. Our reputation as a city is going to suffer.”

A pub spokesman confirmed The Jolly Farmers will be closed today for the visit.

The Three Goats Head Pub in St Michael’s Street, next door to the union, is closing from 4pm. It will therefore have to send staff home and will lose business.

Manager Jaz Rai said: “I believe in free speech, but I’m not sure why the decision was made for the first match, they should have thought about it bit more.”

Society Coffee, opposite The Oxford Union society, which usually closes at 5.30pm, will close at 4pm.

It is alleged that The Plough Inn in St Michael’s Street will be closed and boarded up (Image: Newsquest)

The popular Plough Inn in Cornmarket Street, is believed to be closing and boarding up, according to local pub managers.

Multiple closures are planned for businesses in Ship Street, opposite St Michael’s Street (Image: Newsquest)

In Ship Street, two of the three businesses are remaining open. This includes Crosstown, award-winning doughnut sellers, and No.1 Ship Street, award-winning independent restaurant.

Maddie Holloway, a barista at Crosstown in Ship Street, who will be working throughout the planned demonstration (Image: Newsquest)

Maddie Holloway, barista at Crosstown, will be working during the protest. She said: “There’s been many protests on St Michael’s Street before but they haven’t come here but we would close if there was a danger.”

Manager Jose Toro of New Ground Coffee in Ship Street is closing from 4pm. He said Oxfordshire County Council came to the business to warn them to not have property, such as tables and chairs, outside.

He said: “It’s out of our control but from a business perspective you can’t just shut down the city without asking anyone.”

The White Rabbit in Friars Entry is closing from 4pm to protect customer and staff safety, despite major business losses (Image: Newsquest)

White Rabbit in Friars Entry is closing from 4pm. General manager Edward Whinney, has prioritised staff and public safety, despite a major financial loss.

He said the closure was important as pub closures across the city could push football fanatics and protestors into nearby streets.

He said: “I was really shocked that at a time where there is so much division and anger, the Oxford Union society, which is supposed to hold constructive debates, is choosing speakers where any proper agreement is going to be lost – It is really irresponsible and I think it’s about making a statement.”

He has had to cancel 70 table bookings, losing 20 per cent of business.

He said: “I will fiercely defend free speech, but it’s staggering that businesses who need the help the most are going to be affected the hardest.

“Our first priority is making sure people are safe and happy, so we didn’t want to risk any consequences on our staff and customers.”

The Grapes in George Street is staying open for the first England World Cup game.

Manager Phoenix Herald called the timing of Tommy Robinson’s visit “ironic” but said the historic beer house is “on alert but not letting it dictate” them.

It will have extra security in the form of bouncers with town radio connections and a ‘just in case’ action plan.

Anneliese Dodds has called the behaviour of Oxford Union’s leadership (Image: Constituency office of Anneliese Dodds)

Anneliese Dodds, Labour MP for Oxford East, has called the behaviour of Oxford Union’s leadership “damaging” to the city.

She said: “The Oxford Union’s decision to host Stephen Yaxley-Lennon has already been rightly criticised for ignoring the views of Oxford residents concerned about its impact on community relations.

“Now it appears local businesses are also worried that they could be targeted by supporters of Yaxley-Lennon and the division he promotes.

“When will the Oxford Union’s leadership realise their behaviour is damaging our city?”