European cybersecurity threats rise sharply in 2026, with 4.5 times more phishing emails than in 2025, according to Proofpoint's telemetry.
Article produced with artificial intelligence systems and published under the editorial responsibility of Amelia Tomasicchio. How we work
European cybersecurity threats are growing faster than those in any other region, according to Proofpoint, whose telemetry detected 4.5 times more phishing emails in Europe in 2026 than in 2025, against a 1.5-times increase globally. Its findings span email fraud, cloud account attacks and attempts to compromise the infrastructure behind artificial intelligence tools.
Summary
Key takeaways
- European electronics businesses received BEC emails at 3.4 times the regional average.
- Europe recorded 8.3 clicks per 100 threat emails, versus 2.0 worldwide.
- Cloud attacks targeted 99% of the European organizations Proofpoint observed.
- Attacks on AI building blocks reached a growing share of European sensors.
Email at the center of European cybersecurity threats
Phishing increased sharply in both volume and frequency within European inboxes. Alongside the rise in total phishing emails, Proofpoint recorded a 3.2-times increase in detections per million inbound messages across Europe.
Business Email Compromise, or BEC, stood out in electronics. European companies in that sector received 3.4 times more BEC emails than the European average, with supply-chain invoice fraud the most common pattern.
In BEC attacks, criminals take over a business email account and impersonate its owner when contacting colleagues, partners or customers. Requests typically seek a transfer to an attacker-controlled account or access to business software and data.
Hospitality and healthcare face concentrated attacks
Hospitality, leisure and healthcare faced increases in specific attack types even as malware attacks declined across Europe overall. In hospitality and leisure, malware represented 21% of detections, compared with 11% worldwide, Proofpoint found.
Telephone-oriented attack delivery, also called TOAD or callback phishing, rose 262% year over year. Healthcare experienced a 257% increase in TOAD targeting compared with 2025, alongside an 84% rise in malware.
Proofpoint also pointed to greater engagement with malicious messages in Europe: every 100 delivered threat emails generated 8.3 clicks, versus 2.0 globally. The company suggested that higher responsiveness helps explain attackers’ interest in the region.
Established actors broaden their techniques and targets
Russian and Chinese threat actors remained prominent in Proofpoint’s findings, while actors associated with India and Pakistan appeared to be expanding their attention toward Western Europe in 2026.
The researchers described established groups evolving how they gain and retain access to European organizations. They identified TA395 as among the most prolific actors in their telemetry and highlighted TA488’s targeting of Outlook, Zimbra and other webmail providers.
Actors associated with India and Pakistan had historically concentrated more on targeting each other, the analysis said. Their apparent shift toward Western Europe adds to the state-sponsored and financially motivated activity identified by Proofpoint.
AI infrastructure and cloud accounts come under attack
European cybersecurity threats also reached AI infrastructure and cloud accounts, with 99% of observed European organizations targeted by cloud-based attacks. Phishing and session hijacking affected 64% of targeted organizations, Proofpoint said.
According to the company’s findings, more than 188,000 AI-enabled applications were linked via authentication and OAuth frameworks. These applications are capable of automating workflows at machine speed while accessing APIs and enterprise services. Attackers also targeted connectivity mechanisms, including tokens and applications with misconfigured privileges.
Open-source AI technologies such as Langflow and LiteLLM featured among the targets. The share of European sensors affected by attacks against these AI building blocks increased 4.6 times between consecutive 90-day periods, according to Proofpoint.
Compromise often extended beyond the initial entry. Among European victims, 72% experienced post-breach activity involving efforts to retain access, manipulate authentication controls, access files or abuse compromised mailboxes.
Read also: Physical Bitcoin vs ETF: Pompliano promotes them, but 815,000 BTC are in Coinbase’s hands
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.
