Proofpoint researchers have found that phishing threats increased 4.5 times across Europe from 2025 to 2026, compared with just 1.5 times globally.
The UK is particularly concerned by this trend with a six-fold jump over the same reported period.
The new Proofpoint report, released on November 12, showed phishing detections recorded on the cybersecurity firm’s telemetry from July 2025 to September 2026.
Proofpoint found that today’s phishing threats are drive greater engagement in Europe, with European users clicking on 8.3 out of every 100 delivered threat messages, compared with 2.0 globally.
Precision Cloud Attacks See Success for Attackers
At the same time, the firm found that 64% of European organizations targeted by precision cloud attacks showed evidence of successful compromise.
Speaking to the media during Proofpoint Protect London event, on November 12, Daniel Blackford, VP of threat research, said the researchers derived this finding from account-takeover telemetry, including logging attempts and follow-on actions such as creating email rules or linking apps.
“These targeted attacks use techniques such as phishing and session hijacking to gain access to specific users and accounts, highlighting their effectiveness compared with broader brute-force attacks,” Proofpoint researchers noted.
Espionage and AI Threats Reshape Europe’s Cybersecurity Landscape
European industries are facing increasingly targeted threats. Malware accounted for 21% of detected threats in the hospitality and leisure sector, nearly twice the global rate. Healthcare organizations faced a similarly concerning picture, with callback phishing increasing by 257% year over year and malware detections rising by 84%.
The report also highlighted that espionage operations are expanding across Europe, with South Asian threat actors extending their reach into Western Europe, while Russian and Chinese state-aligned groups continue to evolve their tactics.
At the same time, the growing adoption of cloud services and AI is creating new security challenges.
Proofpoint identified more than 188,000 AI-enabled applications connected through authentication and OAuth frameworks, while the proportion of European sensors affected by attacks targeting open-source AI technologies increased 4.6 times between consecutive 90-day periods.
“Up to last year, I could have said AI for attackers was still a bit too hyped up, but within the last six to eight months, we’ve really started seeing widespread adoption of coding assistants and AI usage across the vast majority of the landscape,” Blackford added.