Threat Intelligence
Curated analysis of live phishing campaigns, attack techniques, and indicators of compromise. Updated by the PhishShield research team. No customer data is used in this feed.
April 2026
Credential Harvesting
41%
O365, Google, banking and HR portal spoofs
Business Email Compromise
24%
CEO fraud, invoice redirection, supplier impersonation
Malware / Ransomware
16%
Malicious attachments and drive-by downloads
MFA Bypass (AiTM)
11%
Session hijacking via reverse proxy infrastructure
Smishing / Vishing
8%
SMS lures and voice-based social engineering
Source: PhishShield platform intelligence & NCSC Q1 2026 report. Aggregated and fully anonymised.
Advisories
TI-2026-041
19 Apr 2026
Mass phishing campaign impersonating HMRC is targeting UK employees with fake tax refund and outstanding balance lures timed around the April deadline. Emails link to convincing gov.uk spoofs collecting National Insurance numbers and banking credentials.
Indicators of compromise
TI-2026-039
15 Apr 2026
Adversary-in-the-middle phishing campaign targeting Microsoft 365 accounts using a reverse proxy to capture session tokens after MFA completion. Victims are redirected to a convincing O365 login page that relays credentials in real time, bypassing MFA entirely.
Indicators of compromise
TI-2026-037
11 Apr 2026
Attackers are sending fraudulent DocuSign requests referencing real company names scraped from LinkedIn. Documents link to cloned DocuSign login pages harvesting credentials. Several UK law firms and estate agencies have reported incidents this month.
Indicators of compromise
TI-2026-034
4 Apr 2026
Ongoing BEC campaign impersonating CEOs and MDs to request urgent gift card purchases from finance staff. Attackers use publicly available LinkedIn data to identify and personalise requests. Average reported loss per incident in the UK: £1,400.
Indicators of compromise
TI-2026-031
28 Mar 2026
High-volume SMS phishing campaign impersonating Royal Mail and DPD asking recipients to pay a £1.99 redelivery fee. Links lead to cloned courier websites collecting card details and personal information. Over 40,000 UK numbers targeted in March alone.
Indicators of compromise
TI-2026-028
21 Mar 2026
Targeted campaign impersonating internal IT helpdesks with personalised emails referencing the recipient's actual organisation name. Emails request password resets via a fake self-service portal. Particularly active against NHS trusts, councils, and universities.
Indicators of compromise
Further reading
Protect your organisation
Run simulations based on the exact attack patterns listed above. See who clicks, who reports, and where your human risk is highest — before a real attacker finds out.