Attackers favor widely trusted platforms while adapting to detection methods, VIPRE’s Q1 2026 email threat trends report reveals
Commercial spam, link-based malspam, and use ofQR code-embedded PDFs are on the rise
LONDON , April 23, 2026 /PRNewswire/ — VIPRE Security Group, a global leader in award-winning cybersecurity, privacy and data protection company, releases its Q1 2026 Email Threat Trends Report, which finds that cybercriminals are stealing trust by exploiting legitimate sites, systems, to achieve easier defense attacks and to achieve defense attacks more easily. Processing 1.8 billion emails in the first quarter of this year, this report highlights the struggles of organizations, and signals areas where they need to strengthen email defenses in the coming months.
Commercial spam takes the lion’s share Commercial spam forms the majority of spam at 46%, delivered via compromised accounts (33%) and free email services (32%). This illustrates trusted platforms and free services as favored attacks by criminals. Commercial spam wears down users with email fatigue, increasing their chances of being phished, while the technique itself helps cybercrime through misleading subject lines, aggressive language, and quick actions.
Almost two-thirds of the spam came from US-based infrastructure, followed by Ireland and the UK. The US was also the top target of commercial spam at 60%, followed by the UK at 12% and Canada at 6%.
Attackers exploit trusted platforms to deliver link-based phishing at scale Cybercriminals increasingly rely on trusted, reputable platforms to carry out their attacks. Phishing accounted for 25.87% of all spam, with malicious links remaining the weapon of choice.
During the first quarter of 2026, embedded links appeared in 50.59% of phishing emails, while 26.69% included attachments, 19.17% used callback schemes, and 3.55% relied on QR code-based phishing. Microsoft continues to be the top brand targeted for spoofing, and “.com” domains remain the primary infrastructure for sending these attacks.
Furthermore, attackers favor “open redirects” that start with the legitimate domain and then end with a parameter routing to a malicious page. Abused URLs accounted for over 89% of phishing URLs.
Cybercriminals are adapting to detection methods The way attackers construct and deploy phishing URLs in Q1 shows that they are adapting to detection methods. Newly registered domains (NRDs) are in decline. As scanners become more effective at identifying newly created domains, cybercriminals are adapting by relying more on familiar, reputable domains to avoid detection. This shift reinforces their tendency to use proven strategies and exploit established, trustworthy web addresses.
Many cybercriminals use Cloudflare to hide their phishing links. By leveraging the platform’s CAPTCHA and bot protection mechanisms, they prevent security scanners from accessing the actual malicious landing pages. This tactic not only allows more phishing emails to pass defenses and reach users, but also increases the perceived legitimacy and quality of these emails.
Callback phishing is another trend Callback phishing remains a strong trend. Common tactics include fake invoices, subscription renewals and account status alerts. Microsoft accounted for 41% of all spoofed brands in callback campaigns, followed by PayPal (17%) and Geek Squad (15%). Runners-up include McAfee, Amazon, Norton, and eBay. Interestingly, to allay suspicion, these callback campaigns were sent from authenticated Microsoft infrastructure, all passing SPF, DKIM, and DMARC checks.
QR code-embedded PDF attachments are increasing PDF files continue to dominate malicious attachments, accounting for 63% of the total. Meanwhile, cybercriminals are increasingly inserting QR codes into these PDFs, allowing them to evade standard URL and text-based scanning methods.
Also, attackers are increasingly using images as attachments with JPGs accounting for 6% and PNGs 4% to bypass text-based detection tools. EML files have also increased, with use in 13.15% of cases. By attaching entire emails, threat actors effectively mimic the format of genuine internal email conversations to bypass secure email gateways.
Link-based malspam delivery is growing In Q1 2026, 84% of malspam emails used link-based delivery. A notable tactic is the use of TestFlight, Apple’s official platform for testing beta versions before release on the App Store. Cybercriminals distributed malware through seemingly legitimate beta channel applications and then sent it to users via the TestFlight link. Since TestFlight is typically seen as trustworthy, the emails greenlit past scanners to land in recipients’ inboxes.
CEO impersonation fails While the C-suite continues to be the primary impersonation focus for cybercriminals, its popularity has dropped from 73% (in Q1 2025) to 54% in Q1 2026. This shift suggests that attackers are adapting to more realistic behaviors—for example, executives follow a chain of command and don’t always reach out directly to the C-suite.
The Swedish language takes second place for BEC English maintains its position as the primary language for business e-mail communication (BEC), accounting for 88%, but the Swedish language took second place, beating Spanish. This highlights the shift of cybercriminals to Nordic countries, possibly due to the region’s adoption of cashless payments, established digitization, high level of public trust, and above average per capita income compared to the rest of the world.
“Attackers use boldly sophisticated techniques to evade detection in addition to manipulating emotional triggers and breaking trust,” says Usman Choudhary, General Manager, VIPRE Security Group. “Organizations must strengthen email defenses and rethink how trust is established across each channel to combat these threats. The landscape requires vigilance and a proactive approach to security. There is no room for complacency.”
To read the full report, click here: VIPRE Q1 2026 Email Threat Trends Report
VIPRE uses its vast understanding of email security to equip businesses with the information they need to protect themselves. This report is based on proprietary intelligence from the round-the-clock assessment of the cyber security landscape.
About VIPRE Security Council Group VIPRE Security Group, part of Ziff Davis, Inc., is a leading provider of Internet security solutions purpose-built to protect businesses, solution providers and home users from costly and malicious cyber threats. With over 25 years of industry expertise, VIPRE is one of the world’s leading threat intelligence clouds, delivering exceptional protection against today’s most aggressive online threats. Our award-winning software portfolio includes next-generation antivirus endpoint cloud solutions, advanced email security products, along with threat intelligence for real-time malware analysis, and high-quality security awareness training for compliance and risk management. VIPRE solutions deliver an easy-to-use, comprehensive layered defense through cloud-based and server security, with mobile interfaces that enable immediate threat response. VIPRE is a proud Advanced Technology Partner of Amazon Web Services, operating globally throughout North America and Europe.
The group operates under several brands, including VIPRE®, StrongVPN®, IPVanish®, Inspired eLearning®, Livedrive®, and SugarSync®. www.VIPRE.com
