Census · Q2 2026

The Phishing Genome

A census of 32,052 attacks from April to June 2026: where the financial risk concentrates, and how much of it passes authentication.

By StrongestLayer Threat Lab Published Sample: 32,052 attacks 8 min read

Key findings

  • 3.6%of attacks carry 98% of the modeled financial risk.
  • 86%of attacks that reached the inbox passed SPF, DKIM and DMARC.
  • 4money-movement attack types carry that risk: CEO fraud, vendor-invoice redirect, payroll and W-2 fraud.

Where the risk concentrates

A small share of attacks, the money-movement family, carries almost all of the modeled financial risk: CEO fraud, vendor-invoice redirect, payroll and W-2 fraud. The rest is noise that fills the queue.

Figure 1 · Share of attacks vs. share of modeled financial risk · n = 32,052

Authentication is not safety

Attackers build on trusted domains and platforms. Authentication says who sent it, not whether it’s safe. Of the attacks that reached the inbox, 86 in 100 passed SPF, DKIM and DMARC.

Figure 2 · 100 attacks that reached the inbox · pink = passed SPF, DKIM and DMARC

The methods, the models, and the full catalog sit behind this summary.

Leave your work email and the full study (PDF) is yours straight away.

By sharing your email you agree to receive occasional product and research email from StrongestLayer. See our privacy policy. Unsubscribe in one click from any email.

Methodology

Sample
32,052 attacks
Period
Apr to Jun 2026
Source
StrongestLayer detections
Risk model
Modeled financial loss by category

Cite this report

StrongestLayer Threat Lab. "The Phishing Genome." Q2 2026. 32,052 attacks. https://www.strongestlayer.com/threat-lab/phishing-genome-q2-2026
Free AI gap check

Do you have an AI gap? Find out what’s getting through.

See which generations of defense you’re running and what it takes to close the gap. Two minutes. No signup. Nothing changes in your environment.

Book a demo Find my AI gap →