APWG says phishing and fraud rose in Q2 2026

Phishing attacks climbed 10% in the second quarter of 2026, while scams, impersonation and business email compromise grew across email, social media, text and voice channels. APWG says the data points to more aggressive, more expensive cybercrime that is spreading across internet-enabled media.

Why it matters: - Cybercrime gangs are using more channels at once, which raises the odds that victims will encounter fraud in email, text messages, phone calls, social platforms and webmail. - The Q2 2026 data shows both higher attack volume and higher-cost fraud, especially in business email compromise. - Social-media fraud and phone-based scams are expanding, which broadens the reach of phishing beyond traditional email attacks.

What happened: - The Anti-Phishing Working Group said phishing attacks increased 10% in Q2 2026, from 971,181 in Q1 to 1,069,681 in Q2. - APWG recorded 425,808 attacks in June 2026, the highest monthly total since April 2023. - APWG published its Phishing Activity Trends Report covering phishing and fraud activity in the second quarter of 2026. - APWG said criminals continued to target users worldwide through email, phone, message services and social media.

The details: - ZeroFox found that nearly 33% of threats on social media were impersonation scams that falsely claimed to be from a real person, brand or organization. - ZeroFox said scams made up almost 23% of social-media threats. - ZeroFox said phishing on social media accounted for 3.5% of threats. - ZeroFox found that these social-media threat categories doubled on a number of platforms from Q1 2026 to Q2 2026. - Fortra said the average wire transfer request in business email compromise attacks reached $61,732 in Q2 2026, up 45% from $42,663 in Q1. - Fortra said the number of wire transfer BEC attacks it observed in Q2 rose 88% from the prior quarter. - Fortra’s John Wilson said there was an uptick in two-step phishing, where an attacker first sends a seemingly legitimate business inquiry and then follows up with a phishing link after the victim replies. - Wilson said the first email can bypass some email filters more easily than typical phishing messages and can create a false sense of security. - Crane Authentication said SaaS and webmail were the most-attacked category in Q1 2026, with 29.1% of all attacks. - Crane Authentication said vishing increased 20% and smishing increased 40% from Q1 to Q2 2026. - Crane Authentication said telephone-based fraud continued to rise. - The full report is available as the APWG report.

Between the lines: - The mix of threats suggests attackers are shifting toward more social engineering and impersonation, not just classic credential-harvesting pages. - The rise in BEC wire-transfer amounts signals greater financial pressure on businesses that process payments or treasury requests. - Two-step phishing shows how attackers are adapting to filter defenses by starting with benign-looking outreach before delivering the malicious link. - The growth in vishing and smishing points to a broader, more persistent fraud ecosystem that is moving across devices and communication habits.

What's next: - APWG members and collaborators will meet in November in Lisbon for the annual eCrime conference. - APWG says the 2026 event will focus on responses to cybercrime and the latest counter-cybercrime research and technology. - The conference runs November 2-6 and is APWG’s 21st annual peer-reviewed publishing symposium on cybercrime. - APWG says the conference theme is “Cybercrime’s Demise Imagined.”

The bottom line: - Q2 2026 data shows cybercrime is growing in volume, spread and sophistication, with fraud now moving aggressively across the platforms people use most.