A new threat-intelligence report from Zscaler tracked a 65 percent year-over-year jump in phishing aimed specifically at service-sector businesses, with roughly 95 percent of those attacks now delivered through encrypted HTTPS connections that traditional email filters cannot inspect. For a small business that runs on email, shared calendars, and a handful of cloud logins, the practical translation is short. The phishing emails landing in your inbox today are sharper, harder to spot, and routed around the controls that quietly handled the older waves.
The shift did not happen because attackers got smarter all at once. It happened because the tools they use got cheaper and the targets they pick got narrower. A small accounting firm, a marketing agency, a property management office, or an insurance brokerage now looks like a higher-yield target than a slow-moving enterprise, and the same generative-AI tools that businesses use to clean up copy are now used to clone a Microsoft, Google, or QuickBooks sign-in page convincingly enough that a careful employee will still misread it.
This is a plain-English look at what changed under the hood, what today’s attack actually looks like for a small office, how your team can verify a sign-in page before typing a password, and which controls catch a phishing site even when a person on staff misses every visual cue.
Why Are Service Businesses Suddenly The Top Target?
Phishing used to chase the largest dollar signs. Banks, hospital systems, defense contractors, and Fortune-500 finance teams absorbed most of the volume because each successful compromise paid out in the millions. That has not stopped, but it has plateaued, in large part because those organizations have full-time security teams, mature email filtering, mandatory hardware-key authentication, and partnerships with incident-response firms on retainer. The economics changed. Attacking a large enterprise is now a multi-month project with a low success rate.
Service-sector small businesses are the opposite kind of target. The dollar value of any single compromise is smaller, but the work required to land one is also dramatically smaller. The same modest team that handles bookkeeping, payroll, vendor contracts, and customer payments usually also handles its own IT, often part-time. The same Microsoft 365 tenant that holds client documents and signed contracts also holds the credentials an attacker can use to redirect a wire transfer or push a fake invoice through a trusted email chain. Multiply that pattern across tens of thousands of small offices and the aggregate payout for the attacker rivals what they once made from large-enterprise breaches, with a fraction of the effort.
The B2B Trust Chain Multiplier
The second reason service businesses moved up the target list is the trust chain that service relationships create. An accountant emails dozens of business clients every month with attachments. A marketing agency sends sensitive logins and brand assets back and forth across email. A property manager forwards invoices and lease documents. Once an attacker controls one of those inboxes, they are not just sitting on one company’s mailbox. They are sitting on a verified, trusted sender address that the next twenty companies in the chain will open without hesitation. The same dynamic shows up in high-stakes impersonation aimed at executives and finance teams, where a single compromised account becomes a relay station for the next round of attacks.
What Does Today’s Phishing Attack Actually Look Like?
The shape of a 2026 phishing attack is unrecognizable to anyone who only thinks about phishing in terms of the 2015 misspelled-Nigerian-prince email. The bait is plausible. The page is pixel-perfect. The domain looks legitimate at a glance. The lock icon in the browser is there and is technically valid. And the attack often does not stop at stealing a password.
The AI-Built Lookalike Page
Building a convincing fake Microsoft sign-in page used to require a designer with patience. Today, a generative-AI tool can produce a pixel-perfect clone of any login screen in seconds, with the right logo placement, the right font weights, the right “stay signed in” checkbox copy, the right error states, and the right hover behaviors. The same tools generate plausible password-reset emails, invoice-renewal notices, and shared-document notifications in whatever tone the attacker needs. The amount of manual craft that used to make phishing a specialty skill has collapsed into a five-minute prompt.
The Encrypted Delivery Channel
Roughly nineteen out of every twenty phishing landing pages now sit behind a valid HTTPS certificate. Free certificate authorities issue those certificates in under a minute, with no manual verification, which means the green padlock icon that older training videos taught employees to look for has stopped meaning anything about whether the page is legitimate. Worse, the encrypted channel means that mid-market email filters and basic web filters that do not perform SSL inspection cannot see what is inside the connection at all. The filter sees a request to a domain it has never blocked before, traffic flowing over TLS, and nothing else. The malicious page itself is invisible to the security layer.
The Real-Time Credential Proxy
The most consequential change is what happens after the employee enters a password. The current generation of phishing kits does not just save the typed credential in a file for the attacker to use later. The fake page proxies the entered username and password directly to the real Microsoft or Google login service in real time, captures the multi-factor authentication prompt as it is sent, and forwards the user’s approval back to the real service. The attacker steals not the password but the active signed-in session token, which is what every cloud service actually checks on every subsequent request. By the time the employee sees the real inbox load and assumes the login was normal, the attacker is already inside the same account on a separate machine. Stopping that pattern is why phishing-resistant multi-factor configuration on the modern standard matters more now than it did when a six-digit text code was the default.
How Can Your Team Verify A Sign-In Page Before Typing A Password?
Awareness training that teaches employees to “look for typos and misspellings” is no longer enough on its own. The current attacks have no typos. The pages have no misspellings. The grammar is professional. The branding is accurate. What still works is changing the verification habit from a visual check to a deterministic check. Three habits, practiced often enough that they become reflexes, will catch most of what humans can still realistically catch on their own.
Check The Full Domain, Not Just The Page
Before typing any password into a Microsoft or Google login page that was reached by clicking a link in an email, the employee should click on the browser address bar and read the entire domain from right to left. The real Microsoft sign-in domain is login.microsoftonline.com, ending in microsoftonline.com. Anything that ends in a different parent domain, no matter how convincing the page looks, is not Microsoft. Attackers know that most readers scan from left to right and stop after they see something familiar, so they put microsoft or microsoftonline at the front of the lookalike (microsoftonline-secure.com, microsoft-365-login.support, login-microsoft-365.net) and trust that the eye will not scroll all the way to the end. Reading right-to-left defeats that trick by design.
Stop Logging In Through Email Links Entirely
The single most effective habit a small office can build is a flat policy that nobody enters a Microsoft, Google, banking, payroll, or accounting-system password into a page that was reached by clicking a link in an email. If the email claims the user needs to sign in, the user opens a new browser tab, types the login URL they already know (or uses the bookmark they have saved), and authenticates there. If the alert was legitimate, the same notification will be waiting inside the actual account. If the alert was phishing, there is no fake page in the picture to begin with. Most credential losses from a small office could be prevented by this single rule alone, because the entire attack chain depends on the employee following the link.
Treat Unexpected MFA Prompts As An Alarm
An unprompted multi-factor authentication notification on a phone is almost never normal. If a phone vibrates with an “Approve sign-in” prompt when the employee was not in the middle of signing in, the right response is to deny the prompt, not to dismiss it. A second unexpected prompt minutes later is a confirmed indicator that an attacker is sitting on the account credentials and is actively trying to break in. The fast escalation path is to change the password from a known-clean device and notify the IT contact the same hour, not the next morning.
What Controls Catch A Phishing Site When People Miss It?
Human vigilance is the last line of defense, not the only one. A small business that depends entirely on every employee getting every link right every time is a small business one tired Wednesday afternoon away from a compromise. The realistic goal is a stack of overlapping controls that each catch a different layer of the attack, so that the attempt has to defeat several independent defenses before anyone on staff is left as the last gate.
DNS And Web Filtering With Newly Registered Domain Blocking
The lookalike domains used in modern phishing campaigns are usually registered hours or a day before the campaign launches. A DNS filtering layer that blocks newly registered domains by default removes most of those destinations before the browser ever loads them, regardless of whether the email itself slipped through. Web filtering at the office network level adds the same protection for the workstations sitting on the office LAN, and roaming agents extend it to laptops outside the office. None of this requires the employee to make a judgment call. The page never finishes loading.
Phishing-Resistant MFA Instead Of SMS Or Push
The real-time credential-proxy attack defeats SMS codes and approval-style push notifications because both still rely on the user approving an authentication challenge that the proxy is transparently relaying. Phishing-resistant authentication methods (a physical hardware security key, passkeys bound to the device, or certificate-based authentication) cryptographically verify that the page asking for the credential is the genuine login service. A lookalike domain cannot present the right cryptographic challenge, so the hardware key or passkey simply refuses to sign in. The attack chain breaks at the authentication layer regardless of what the employee clicked.
Email Defense That Inspects Links After The Click
The defensive layer that closes the encrypted-channel gap is server-side link inspection that follows the link in a sandboxed browser at the moment the user clicks it, not at the moment the message is delivered. This catches the common attacker move of waiting until the email has cleared the filter before flipping the destination to the live phishing page. A managed email security service that runs that kind of after-click inspection, combined with Defender for Business email rules and Conditional Access policies that a Microsoft 365 Business Premium tenant unlocks, removes a large chunk of the lookalike-domain traffic before the employee even sees the fake page.
A Rehearsed Response Plan For When A Credential Gets Captured
Even with every control on, some percentage of attacks will succeed. The difference between a minor incident and a multi-week recovery is whether the office has a rehearsed plan for the next sixty minutes after someone realizes they typed a password into the wrong page. Resetting the password and revoking active sessions across all devices in the same step, checking inbox rules for newly created forwarding addresses, reviewing the OAuth grants for any application the employee did not authorize, and notifying the IT contact and the cyber insurance carrier are all on the response checklist for a captured credential. Reading that checklist for the first time during an incident is too late.
Frequently Asked Questions About Modern Phishing Attacks
What does “65 percent jump” actually mean for a single small office?
The 65 percent figure is an industry-wide year-over-year increase in phishing volume aimed at service-sector businesses, not a guarantee that a specific office will see that exact uptick. The practical translation for a ten-to-fifty-person small office is that the inbox you saw at this time last year and the inbox you are looking at now are not the same threat surface. A volume of suspicious mail that used to slip through once a quarter now slips through once a month, and the messages that do land are noticeably better. Treating phishing prevention as a once-a-year staff training is no longer adequate; the surface keeps moving in between trainings.
Does the green padlock in the browser still mean a site is safe?
No, not in the way older guidance suggested. The padlock confirms that the connection between the browser and the site is encrypted, which prevents third parties from eavesdropping. It says nothing about who runs the site. Free certificate authorities issue valid certificates for any domain that can prove control over the DNS record, including newly registered lookalike domains created hours before a phishing campaign launches. The padlock is now table stakes for any website, malicious or legitimate, and its presence is not a useful trust signal on its own.
If our team uses multi-factor authentication, are we already protected?
Multi-factor authentication is still essential and still blocks the large majority of credential-stuffing attacks, but the specific form of MFA matters now. SMS codes and “tap to approve” push notifications can be relayed by a real-time phishing proxy in the seconds between the user entering the code and the real login service accepting it. Phishing-resistant methods (hardware security keys, passkeys bound to the device, or certificate-based sign-in) refuse to authenticate to a lookalike domain at all, which is the property that defeats the modern attack chain. Most small offices on Microsoft 365 or Google Workspace can move to phishing-resistant methods at no additional license cost; the missing piece is usually the configuration work, not the entitlement.
Can our existing email filter catch AI-generated phishing emails?
Partly, and the gap depends on the filter. Older filters built around keyword matching, sender-reputation lists, and known-bad URL blocklists miss most AI-generated phishing because the language is novel, the sending infrastructure is freshly purchased, and the destination domain has no prior reputation either way. Modern email security services that inspect intent, behavior, and writing patterns catch a much larger share, but no filter catches everything. The realistic posture is that the email layer catches the obvious 80 to 90 percent, the user catches some of the remainder, and the authentication layer (phishing-resistant MFA) is the safety net for whatever still gets through.
How often should we run phishing-awareness exercises for staff?
The pattern that produces results is frequent, short, and varied. A monthly simulated phishing email tailored to the office’s actual workflow (a fake invoice from a real vendor, a fake password-reset from a tool the team actually uses, a fake shared-document notification from a service that was just rolled out) keeps the recognition habit current. Quarterly thirty-minute training sessions reinforce specific habits like reading the domain right-to-left and refusing email-link logins. Annual hour-long compliance training in isolation does not move behavior; the spacing matters more than the total minutes.
What is the first sign that one of our accounts has been taken over?
The earliest indicator is usually an inbox rule that the user did not create. Modern account-takeover attacks immediately add a rule that auto-forwards incoming mail (especially anything that looks like a wire-transfer confirmation or an invoice) to an external address, then auto-deletes the original so the legitimate user never sees the reply. Other early signs are unexpected mail showing as read when the user has not opened it, sent items the user did not send, OAuth grants to applications the user does not recognize, and sign-in locations on the account activity log from cities or countries the user has not visited. A managed IT provider running modern monitoring on the Microsoft 365 or Google Workspace tenant should catch the inbox-rule creation in real time, not days later.
Is cyber insurance still going to pay if we get hit by a phishing-driven incident?
It depends on the carrier and the controls that were in place at the time of the incident. Carriers have steadily tightened the security control requirements that are baked into the policy. Multi-factor authentication on every cloud account is now nearly universal as a baseline. Many carriers now also require phishing-resistant MFA on the highest-privilege accounts, regular phishing-awareness training, email security with link inspection, and documented incident response. A policy that was issued two years ago against weaker controls may quietly exclude the exact phishing pathway that is now most common. Reading the current policy with the IT partner, before the next renewal, is the cheapest insurance audit a small business can run.
Where Should A Small Office Start This Week?
The right first move for a service-sector small business is to spend an hour answering five questions, in order, with specifics rather than impressions. Is every cloud account on phishing-resistant multi-factor authentication, and which accounts are still on SMS or push approval? Is the email filter set to inspect links at click time, not just at delivery time? Does the office have DNS or web filtering that blocks newly registered lookalike domains? Is there a written checklist for what happens in the first sixty minutes after someone realizes they entered a credential into the wrong page? And when was the last time the staff ran a realistic phishing simulation against their actual workflow? A clear answer to each of those is the baseline; a vague answer is where to start. A managed email-security and phishing-defense program that owns the configuration, the inspection layer, and the staff exercises together closes the most common gaps in a single coordinated rollout instead of leaving each piece to drift on its own schedule.