Europe’s threat landscape is evolving rapidly. State-aligned actors are broadening their targeting, cybercriminals are running increasingly sophisticated and localised campaigns, and cloud and AI adoption is creating new opportunities for attackers.
Proofpoint® threat researchers have observed expanding espionage operations, rising phishing activity, increasingly effective precision cloud attacks and growing targeting of AI infrastructure. Together, these trends show how attackers are adapting their techniques to target people, identities, applications, and emerging technologies across Europe.
Key findings
- Phishing activity surged across Europe. Phishing detections increased 4.5× year-over-year.
- State-aligned targeting is expanding. South Asian threat actors are broadening their operations into Western Europe, while Russian and Chinese actors continue to adopt new techniques.
- Precision cloud attacks are proving particularly effective. In Europe, 64% of organisations targeted by precision attacks showed evidence of impact.
- AI infrastructure is emerging as a new attack surface. The share of European sensors affected by attacks targeting open-source AI technologies increased 4.6× between consecutive 90-day periods.
- Cybercrime is becoming increasingly localised. Threat actors are targeting European transportation, financial services, and healthcare organisations with tailored phishing, credential theft, and malware campaigns.
Email threats intensify across Europe
Email remains a critical attack vector for European organisations. Proofpoint data shows phishing detections increased 4.5× across Europe year-over-year, significantly outpacing the 1.5× increase observed worldwide. Even accounting for higher email volumes, phishing increased at a faster rate, with detections per million inbound messages rising 3.2× across Europe.
Figure 1: Europe vs worldwide phishing growth
The threat landscape also varies considerably by industry. European hospitality and leisure organisations face a particularly malware-heavy threat mix, with malware accounting for 21% of detected threats compared with 11% worldwide. Telephone-oriented attack delivery (TOAD), or callback phishing, targeting the sector also increased 262% year-over-year.
Healthcare organisations are experiencing a similar shift. TOAD targeting European healthcare increased 257% year-over-year, while malware rose 84%, despite malware declining across Europe overall.
Business email compromise (BEC) also remains a concern. European electronics companies received BEC and impostor messages at 3.4× the European average, with supply-chain invoice fraud a common pattern.
Perhaps most significantly, threats that successfully reach European inboxes are considerably more likely to result in engagement. Proofpoint observed 8.3 clicks for every 100 delivered threat messages in Europe, compared with 2.0 worldwide, underscoring the continued importance of the human layer in the European threat landscape.
Figure 2: Europe vs worldwide click rate
Espionage operations broaden and evolve across Europe
Proofpoint researchers have observed a broadening of state-aligned threat activity affecting Europe in 2026. South Asian threat actors are expanding beyond their traditional regional focus, while established Russian and Chinese actors continue to evolve their techniques to gain and maintain access to European organisations.
South Asian threat actors expand their reach
Historically, Indian and Pakistani cyber operations have largely focused on each other and neighbouring countries. In 2026, however, Proofpoint researchers observed South Asian threat actors expanding their targeting into East Asia and Western Europe.
Figure 3: Likely LLM-created TA395 intermediate pages requiring CAPTCHA/click resolution to reveal phishing landing pages
These actors frequently combine credential harvesting with malware delivery. TA395, one of the most prolific actors observed in Proofpoint telemetry, initiates multiple distinct campaigns each week and continues to develop custom malware and evolving phishing kits. Proofpoint researchers assess that the use of large language models (LLMs) has very likely accelerated this development.
Russian actors adopt new access techniques
Long-established Russian threat actors are also evolving their targeting of Europe, adopting techniques that require less social engineering from their victims. TA488, for example, has used half-click exploits targeting Outlook, Zimbra, and other webmail providers. Proofpoint researchers assess that LLM-assisted research has accelerated exploit discovery in this area.
Figure 4: Half-click exploitation flow and worldwide government response
Other Russian actors have used device-code and App-Specific Password (ASP) phishing kits to gain access to inboxes without requiring victims to directly enter their credentials. This includes the threat actor UNK_AcademicFlare, which has continued to target government, education, and think tank organisations in Europe in 2026.
Chinese targeting extends to AI
Chinese state-aligned actors have similarly adopted browser and webmail exploitation to establish footholds and maintain long-term access to targeted networks. Researchers have also observed the use of Adversary-in-the-Middle (AiTM) phishing kits, including both custom tooling and publicly available frameworks such as Evilginx.
While European government and defence organisations have long been targets for these actors, Proofpoint researchers have also recently observed their scope expanding to include AI policy targets.
Cloud and AI expand the attack surface
As European organisations increase their reliance on cloud services and AI-enabled applications, threat actors are increasingly targeting the identities, applications, and access permissions that connect them.
Proofpoint researchers found that 99% of European organisations observed were targeted by cloud-based attacks, with precision attacks proving particularly effective. Unlike broad brute-force attacks such as password spraying, precision attacks use more targeted techniques - including phishing and session hijacking - to compromise specific users and accounts. These attacks impacted 64% of targeted organisations in Europe, compared with 33% for brute-force attacks, highlighting how targeted techniques can be significantly more effective at gaining access.
| Brute-Force Attacks | Precision Attacks | |
| Organisations Targeted | 99% | 98% |
| Organisations Impacted | 33% | 64% |
Figure 5: Leading cloud threat vectors in Europe
Compromise is often only the beginning. Across Europe, 72% of organisations observed post-access activity, as threat actors sought to maintain access, manipulate authentication controls, access files, or abuse compromised mailboxes.
AI introduces a new attack surface
The rapid adoption of AI is adding another dimension to this risk. Proofpoint telemetry identified more than 188,000 AI-enabled applications connected through authentication and OAuth frameworks. These applications can automate workflows and access APIs and enterprise services at machine speed, making visibility and control over identities, applications and permissions increasingly important.
Threat actors are increasingly targeting the mechanisms that enable this connectivity, including consent grants, stolen tokens, and overprivileged applications. At the infrastructure level, Proofpoint has also observed increased exploitation attempts against open-source AI technologies such as Langflow and LiteLLM. The share of European sensors affected by attacks targeting these AI building blocks increased 4.6× between consecutive 90-day periods, demonstrating how AI infrastructure itself is becoming an increasingly attractive target.
Cybercrime actors target Europe with increasingly localised campaigns
Alongside state-aligned activity, Proofpoint researchers continue to observe financially motivated threat actors targeting organisations and individuals across Europe. These campaigns are often highly localised, using region-specific brands, languages, and lures to increase their chances of success.
Recent notable activity spans transportation and logistics, financial services, and healthcare, with threat actors deploying techniques ranging from credential phishing and real-time phishing kits to remote access malware. In some cases, researchers have also observed evidence of AI-assisted malware development.
Cargo and transportation targeting
Cybercriminal threat actors continue to target the European transportation sector, with a particular focus on freight brokerage, ground logistics, and trucking. Targeted countries include Germany, France, Hungary, Italy, Croatia, Romania, and Spain, among others.
Recent activity includes remote access trojan (RAT) delivery campaigns targeting freight and logistics operators, as well as credential phishing operations impersonating TIMOCOM (a major European freight marketplace). Several campaigns show evidence of AI-assisted malware development.
As Proofpoint previously reported, phishing campaigns targeting logistics and transportation firms can lead to real-world cargo theft. According to the European Commission, financial losses due to cargo theft across the European Union are estimated at EUR 8.2 billion annually. Digital transformation across the sector has contributed to an increase in cyber-enabled theft. Threat actors can compromise trucking and freight organisations and use their access to bid on cargo shipments, which are then stolen and resold.
UAC-0050
The threat actor UAC-0050 has employed Remote Monitoring and Management (RMM) tools such as Remote Manipulator System (RMS) to target Ukrainian organisations. UAC-0050 (also known as the DaVinci Group) is a Russia-aligned threat actor active since at least 2020 that primarily targets Ukrainian government, financial, and public-sector organisations.
TA2730
Cybercrime actor TA2730 regularly targets retail investors and brokerage customers across Europe. In recent months, the actor’s targeting includes organisations in the United Kingdom, Switzerland, Germany, Italy, Belgium, Denmark, and the Netherlands. Lures are always localised into the appropriate language, and impersonate investment and financial entities including Swissquote, Binance, Interactive Brokers, and many others. Typically, the actor uses a W-8BEN tax form email phishing lure — a legitimate compliance document familiar to European investors with US-based holdings.
The primary impact of these campaigns is account takeover. TA2730 operates a real-time phishing kit — meaning a live operator monitors each victim’s session as they enter their credentials, allowing stolen login details and multi-factor authentication codes to be used immediately before they expire. For investment and brokerage accounts, this creates direct financial exposure and could lead to unauthorised withdrawals, liquidation of positions, or fraudulent transfers. The actor’s infrastructure is purpose-built, scalable, and rotated regularly to evade detection, indicating an organised operation capable of sustaining this tempo across multiple countries and brands simultaneously.
TA2725
TA2725 is a financially motivated threat actor primarily associated with Latin American banking malware. Although the group generally targets Latin America, European targeting includes organisations in Spain and Portugal, and at least once in Italy. Within Europe, Spain is TA2725’s most consistently and heavily targeted country, appearing as a target in nearly every campaign observed since mid-2025. TA2725 operates a persistent email campaign infrastructure that delivers banking trojans and remote access tools against Spanish- and Portuguese-speaking targets across multiple continents. The actor’s core malware includes Mispadu (also tracked as Ursa Loader), Metamorfo (and its variant Horabot), Astaroth, Grandoreiro, and a newly observed payload identified as FluxEngine RAT. All campaigns are consistently geofenced, meaning the download gates and staging infrastructure restrict access based on the visitor’s IP geolocation, ensuring payloads are delivered only to intended targets. Lures are localised in Spanish or Portuguese and are typically themed around judicial summons, legal notifications, overdue invoices, and business document requests, exploiting the perceived urgency of legal and financial correspondence.
Novel French health system campaign targets user data
On September 9, researchers identified a credential phishing campaign impersonating Ameli, the French National Health Insurance organisation. These messages contained URLs that led – after Cloudflare filtering and a novel CAPTCHA – to a counterfeit Ameli portal designed to steal user credentials.
Figure 6: Impersonated Ameli landing page.
The infrastructure in this campaign included hundreds of malicious domains, and the actor was using a previously unobserved credential phishing kit. Proofpoint researchers assessed the activity as more evolved than what is typically seen for high-volume phishing impersonating health agencies.
On August 13, French authorities revealed a breach of taxpayer data that impacted hundreds of thousands of citizens. According to a report by ANSSI, France’s national cybersecurity agency, the breach was successful due to poor security practices at the tax administration.