Targeted Email & Phishing — Techniques That Beat MFA

Phishing is the longest-lived intrusion technique. DBIR 2026 keeps it at 16% of initial access vectors, while "pretexting" — scams built on fabricated premises — grew to 6%, feeding ransomware and extortion. Japan logged about 730,000 phishing reports in the first half of 2026; by press accounts roughly 45% of the delivery servers sat in Chinese networks.

The technique has evolved from "type your password into a fake page" to adversary-in-the-middle attacks that defeat multi-factor authentication. In AiTM, the attacker's server proxies the real login screen in real time — the user completes genuine MFA, and the attacker steals the resulting session cookie.

In our incident data, phishing-initiated leaks are few in number, but severity spikes when a single case turns into business email compromise with payment authority, or into follow-on unauthorized access.

As the NPA's analysis showed, about 45% of the delivery infrastructure for Japan's ~730,000 reports sits abroad, mainly in Chinese networks. Meanwhile AI-generated text has erased the once-telltale awkward Japanese, making fraudulent mail harder to spot.

The strongest technical countermeasure is phishing-resistant authentication. FIDO2/passkeys never send credentials to a fake site, neutralizing most phishing including AiTM. Pair them with business rules for payments and contract changes (multi-approval, callback by phone) to counter BEC.