Phishing threats in Europe rose 4.5 times between 2025 and 2026, according to telemetry analyzed by Proofpoint, a jump that outpaces the 1.5× increase seen globally.
Phishing surge across Europe and the acute UK spike
Proofpoint’s report, released on November 12 and based on telemetry collected from July 2025 to September 2026, shows a markedly faster rise in phishing activity in Europe than the rest of the world. The United Kingdom stands out with a six‑fold increase in phishing detections over the same period. European recipients are engaging with these messages at a higher rate: Proofpoint found European users click on 8.3 out of every 100 delivered threat messages, compared with 2.0 globally.
Precision cloud attacks: account takeover and follow‑on actions
Proofpoint highlights that precision cloud attacks are delivering returns for attackers: 64% of European organisations targeted by these attacks showed evidence of successful compromise. Speaking to the media at the Proofpoint Protect London event on November 12, Daniel Blackford, vice‑president of threat research, said researchers derived that finding “from account‑takeover telemetry, including logging attempts and follow‑on actions such as creating email rules or linking apps.”
Proofpoint researchers emphasised the mechanics behind those successes: “These targeted attacks use techniques such as phishing and session hijacking to gain access to specific users and accounts, highlighting their effectiveness compared with broader brute‑force attacks.” The firm’s telemetry therefore ties initial phishing delivery to downstream changes in account behaviour that indicate persistent access.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleSector impacts: hospitality, healthcare, and expanding espionage
The geographic and tactical trends show up unevenly across sectors. Malware accounted for 21% of detected threats in the hospitality and leisure sector in Europe — nearly twice the global rate reported by Proofpoint. Healthcare organisations saw especially severe shifts: callback phishing rose by 257% year on year and malware detections increased by 84%.
The report also documents an espionage dimension. Proofpoint says South Asian threat actors are extending their reach into Western Europe, while “Russian and Chinese state‑aligned groups continue to evolve their tactics,” indicating a wider array of nation‑state or state‑aligned activity shaping Europe’s threat environment.
AI, OAuth and open‑source tooling: the new attack surface
Cloud and AI adoption are complicating defenders’ work. Proofpoint identified more than 188,000 AI‑enabled applications connected through authentication and OAuth frameworks, creating large numbers of new third‑party connections that can be abused. Separately, the proportion of European sensors affected by attacks targeting open‑source AI technologies rose 4.6 times between consecutive 90‑day periods.
On the role of AI in adversary toolkits, Blackford was blunt: “Up to last year, I could have said AI for attackers was still a bit too hyped up, but within the last six to eight months, we’ve really started seeing widespread adoption of coding assistants and AI usage across the vast majority of the landscape.” That shift, Proofpoint’s telemetry suggests, is showing up both in the volume of connected AI apps and in targeting of open‑source AI components.
What this means for security teams, enterprises in hospitality and healthcare, and policymakers
- Security teams and technologists: the combination of higher click rates in Europe and successful precision cloud compromises points to the need to track account‑takeover indicators beyond initial delivery — monitoring for email rules, new OAuth app links and session anomalies is what Proofpoint used to measure compromise.
- Enterprises in hospitality and healthcare: the report gives concrete numbers to the threat mix — 21% malware in hospitality detections and healthcare seeing callback phishing +257% and malware +84% — making these sectors clear priorities for focused detection and response activity.
- Policymakers and national cyber authorities: the expansion of espionage activity into Western Europe by South Asian actors and the continuing evolution of Russian and Chinese state‑aligned groups underscore a shifting geopolitical footprint that, according to Proofpoint’s findings, is interwoven with criminal and technical developments such as AI‑enabled tooling.
Proofpoint’s telemetry paints a picture of attackers refining both social engineering and cloud‑level footholds: more messages are being delivered, European recipients are clicking at higher rates, and precision cloud techniques are producing measurable account compromises. The convergence of phishing, account‑takeover signals and growing AI‑related connections poses a concrete test for defenders, enterprises and policy planners in Europe as they match posture to the data Proofpoint published on November 12.
Source: Infosecurity Magazine — Phishing rises faster in Europe (Proofpoint report)
