BI.ZONE experts: AI and deepfakes made phishing sharper and more dangerous in 2026

Phishing has become noticeably smarter in 2026. Mass emails have not gone away, but the main growth is now in personalized, multi-stage attacks using AI and deepfakes. BI.ZONE experts say technology has changed the packaging of fraud, but not the logic of defense: verification, a second communication channel and 2FA still do a lot of the work.

How phishing has changed

AI has sharply cut the cost of preparing attacks. Where criminals once had to churn out generic emails, they now collect open data about a person and tailor the message to their job, social circle and the services they habitually use. Deepfakes amplify the effect: a forged voice, a similar-looking face and a familiar manner of speaking help attackers gain trust faster. Scenarios work especially well when the attacker poses as a relative, colleague or boss and demands urgent action.

Channels have also become more targeted. For mass reach, scammers go to social networks and messengers, create themed chats, send direct messages and leave links in comments. For businesses, though, email remains the critical entry point: according to BI.ZONE, 64% of targeted attacks on companies in Russia and the CIS begin with phishing emails. Phone and video calls add what text lacks — pressure, a sense of urgency and the illusion of personal contact, which makes victims more likely to take impulsive decisions.

Which schemes work

BI.ZONE has observed that since October 2025, scammers have shown markedly more interest in messenger accounts and personal accounts on government services portals. At the same time, the Ghost invoice scheme is growing: attackers register domains resembling the websites of large companies, send out commercial offers and slip in fake invoices. To the victim it looks like an ordinary purchase; for the company being imitated, it ends in reputational damage.

Here are the most effective scenarios in use most often right now.

• Fake notifications from banks, tax authorities and government services
• Fake Boss, where an employee gets a message from a "manager" who prepares them for a call from "law enforcement" or a regulator
• TOAD schemes, where the victim is asked to call back themselves, bypassing call anti-spam
• QR codes in crowded places leading to fake forms
• Phishing mobile apps imitating legitimate services

Another trend is the industrialization of phishing. Phishing-as-a-Service lowers the barrier to entry: ready-made platforms help deploy fake pages, adapt them to user behavior and even bypass some MFA scenarios. Combined with generative AI, this turns phishing into a conveyor belt. The number of phishing sites fell to 12.5 thousand in the first quarter of 2026, against 17.5 thousand a year earlier, but that does not mean there are fewer threats: scammers are shifting to more complex and more profitable multi-step attacks.

What helps defend against it

For ordinary users, basic rules are still more effective than anything exotic. It is important to follow only official addresses, not to open attachments and links from unexpected messages, and to double-check urgent requests through another communication channel. If a voice or video message arrives from an acquaintance asking for money, look for inconsistencies: odd facial expressions, unnatural intonation, poor recording quality, unfamiliar phrasing. And it is better to enable two-factor authentication through an app rather than rely on SMS alone.

"If something looks suspicious, it is better to double-check through

official channels."

For companies, defense has long since stopped being just anti-spam. They need secure communication channels, regular employee training and additional checks in critical processes. The "second pair of hands" principle works well, where a transfer, a change of bank details or the granting of access is confirmed by another trusted employee. Companies also need tools to detect deepfakes, clear procedures and fast incident response, before an attack has time to complete all stages of the chain.

Multi-stage schemes are especially dangerous because each individual step can look harmless. First comes an "erroneous transfer," then intimidation begins, and then the victim is persuaded to send the money onward or hand it to a courier. Other scenarios use SMS bombing: the person is flooded with messages, then receives a call supposedly from the bank offering to urgently "save" the account. This theater of pressure targets not a technical vulnerability but fatigue and anxiety.

What this means

Phishing in 2026 is no longer just a forged email but a service economy of fraud, boosted by AI, deepfakes and ready-made platforms. According to BI.ZONE, damage from such schemes in 2025 alone exceeded 18 billion rubles. For users and businesses the conclusion is simple: the winner is not whoever has the trendiest tools, but whoever can verify faster and has discipline and healthy skepticism.